Malicious ** 3-August-09 www.sans.cn

sans.cn(219.133.31.107-Blacklisted)

Other domains share with same IP address:

mail.sans.com.cn

mx.sans.com.cn

sans.com.cn

www.sans.com.cn

vm1.1158tv.cn (111.111.222.111-Blacklisted)

Level 0:http://www.sans.cn/img/muma.html

Level 1:http://www.sans.cn/img/darkst.png

Level 1:http://www.sans.cn/img/js.js

Level 2:http://www.sans.cn/img/z.htm

Level 3:http://www.sans.cn/img/do.css

Level 4:http://vm1.1158tv.cn/game/zzz/tj.exe

Level 3:http://www.sans.cn/img/z.css

Level 4:http://www.sans.cn/img/1.html

Level 2:http://www.sans.cn/img/ggvod.htm

Level 2:http://www.sans.cn/img/gf22.htm

Level 3:http://www.sans.cn/img/swfobject.js

Level 2:http://www.sans.cn/img/gi11.htm

Level 3:http://www.sans.cn/img/swfobject.js

Level 1:http://s52.cnzz.com/stat.php?id=930206&web_id=930206&show=pic1

Analysis report for malicous file("tj.exe") activity:

http://anubis.iseclab.org/?action=result&task_id=1c30fe1b4c02e457435b1482d5b6203bf&format=html

Tools:

-Robtex

-Anubis

-malzilla

--X0end