What generic malware resides on this vulnerable site?

See: https://www.virustotal.com/url/e484ff526129698b4b3f2f5878ab370a316802781e713d0af55a10a6c001fb80/analysis/1354716042/
Nothing here: http://urlquery.net/report.php?id=315590
Only netcraft flags this site as a known PHISHING website
Quttera flags this
html5shim.googlecode dot com/svn/trunk/html5.js?ver=3.3.1
File size[byte]: 2394
Threat type: Potentially Suspicious
Details: Our investigation system run out of memory used for execution process.
Reason: Reached execution stack limit. Stack content: [ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ][ c ]
MD5: 69431F1EC831BACF31013DFF2872CBA0
Scan duration[sec]: 0.059000 [Quttera’s scan results data]
Why this site has issues is given at Sucuri’s
Web application version:
WordPress version: WordPress 3.3.1
Wordpress Version 3.3.2 based on: htxp://stacjaobslugi.pl/wp-admin/js/common.js
WordPress theme: hxtp://stacjaobslugi.pl/wp-content/themes/blogolife/
Wordpress internal path: /wp-content/themes/blogolife/index.php
WordPress version outdated: Upgrade required.
Offending raw content flagged et Tax Refund Online Form<meta http-equiv=“REFRESH”
content=“0;url=htxp://spzabelkow.krzyzanowice.pl/refunded/getStatus_en.htm” (mailserver 77.55.115.57- associated harvester 87.204.151.193! )
Bad web rep here: http://www.mywot.com/en/scorecard/spzabelkow.krzyzanowice.pl?utm_source=addon&utm_content=popup-donuts

polonus

P.S. For mentioned IP for stacjaobslugi.pl I get http://79.96.113.114/ Strona w przygotowaniu meaning in Polish “site under construction”

D

The site does not give anything out to the world, but via other resources we have found that that site is running IdeaWebServer/v0.80, which is vulnerable to JS:Redicrector-ZK[Trj] malware & this malcode will be flagged by avast Webshield…
Site could also have been hacked via askimet: http://wordpress.org/support/topic/site-hacked-through-akismet (article author = Bratuh Alexander) via spam attacks…as the worst of the 80% spam content sent is being removed …

polonus