HTML_IFRAME.MVI

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be hosted on a website and run when a user accesses the said website.

It does not have any propagation routine.

It does not have any backdoor routine.

This is the Trend Micro detection for Web pages that were compromised through the insertion of a certain IFRAME tag.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be hosted on a website and run when a user accesses the said website.

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Other Details

This is the Trend Micro detection for Web pages that were compromised through the insertion of a certain IFRAME tag.

It does the following:

• It includes IFRAME tags that redirect the user to the following URLs:
  • https://meine.deutsche-bank.de/mod/WebObj
  • http://{BLOCKED}l.ca/tmp/Reconfirm%20Account%20Details.zip
  • http://www.{BLOCKED}tone.com/counter/taskmgr.exe
  • http://j.{BLOCKED}c.us/14.htm
  • http://j.{BLOCKED}c.us/15.htm
  • http://{BLOCKED}9.BIZ/NEW/SDFG.JAR
  • http://{BLOCKED}9.BIZ/NEW/POST.PHP
  • http://SCANNER.{BLOCKED}SCANNER.COM/SETUP/FILE.PHP
  • http://SCANNER.{BLOCKED}NNER.COM/SETUP/INSTALL
  • http://SCANNER.{BLOCKED}N.COM/SETUP/INSTALL
  • http://SCANNER.{BLOCKED}NTIVIR-2009.COM/SETUP/INSTALL
  • http://www.{BLOCKED}8.cn/vip.htm
  • http://www.{BLOCKED}a.com/temp1.html
  • http://web.{BLOCKED}n.cn/dww/vip.htm
  • http://{BLOCKED}k.my.9929.net/Swordsman.htm
  • http://dengweiwen.{BLOCKED}y.net/Swordsman.htm
  • http://www.{BLOCKED}n.cn/muma.htm
  • http://guxing.{BLOCKED}j.com/wm.htm
  • http://bs521.{BLOCKED}2.org/wm/girl.htm
  • http://88.{BLOCKED}5.com/in.htm
  • http://wx.{BLOCKED}v.com/m.htm
  • http://3w.{BLOCKED}rou.cn/28159386.htm
  • http://{BLOCKED}searchinc.com/spl/index.php
  • http://www.camela.{BLOCKED}l.in/spl
  • http://wm.{BLOCKED}i.com
  • http://www.{BLOCKED}g.org/b/zx11.html
  • http://www.{BLOCKED}g.org/b/zx10.html
  • http://{BLOCKED}ames.info/st/go.php
  • http://{BLOCKED}.{BLOCKED}.232.33/gpack/index1.php
  • http://{BLOCKED}.{BLOCKED}.232.33/01/01/update.php
  • http://{BLOCKED}.{BLOCKED}.232.33/counter.php
  • http://{BLOCKED}.{BLOCKED}.232.33/nonick/index.php
  • http://{BLOCKED}6power.ru/cfi/index.php
  • http://{BLOCKED}1.com/cgi-bin/index.cgi
  • http://{BLOCKED}4.com/cgi-bin/index.cgi
  • http://{BLOCKED}8.com/cgi-bin/index.cgi
  • http://{BLOCKED}adw.com/cgi-bin/index.cgi
  • http://{BLOCKED}aff.cn/in.cgi
  • http://www.{BLOCKED}k.cn/120.htm
  • http://{BLOCKED}lemk.cn/xi/xx.htm
  • http://{BLOCKED}23k.cn/xi/xx.htm
  • http://user1.{BLOCKED}2.cn/14.htm
  • http://www.{BLOCKED}1.com/admin/hh.htm
  • http://web.{BLOCKED}n.cn/yz888/vip.htm
  • http://w.{BLOCKED}d.com/bd.htm
  • http://mary12345lt.{BLOCKED}z.com/deftu.html
  • http://user.free.{BLOCKED}9.net/hurricaneps/mm/gh.htm
  • http://lizhenhai.{BLOCKED}p.cc/s8.htm
  • http://www.{BLOCKED}op.cn/qq.htm
  • http://w.{BLOCKED}d.com/bd.htm
  • http://kenng1.{BLOCKED}n.com/k/index.htm
  • http://xxx.{BLOCKED}x.cn/wm.htm?id={ID}
  • http://www.{BLOCKED}2.com/defaul.htm
  • http://j.{BLOCKED}1.com/gunianmu/wm.htm
  • http://www.{BLOCKED}e.cn/dk/2.htm
  • http://1008611.{BLOCKED}j.com/help.htm

NOTES:

Note that the malware does not run by itself.

It does not have rootkit capabilities.

It does not exploit any vulnerability.