See: https://www.virustotal.com/en/url/53996a3d0317e20f86b9375e2016550ec745317fa238f9cca04a39f8a27ed4ac/analysis/1361116773/
See: https://www.virustotal.com/en/file/f5f7cfd8156b4afa3f7bba3ed4d30230e19189cc6db6411b6ab2b86f7791ce88/analysis/1361116778/
Re: http://anubis.iseclab.org/?action=result&task_id=19da2456a899da1b401b396d3d86acd77&format=html
polonus
First seen by VirusTotal
2013-02-17 15:59:38 UTC ( 51 minutes ago )
This is the second external js script seen in the urlquery dot net scan: var sc_img1 = new Image();
sc_img1.src = “htxp://c.statcounter.com/t.php?sc_project=872265&resolution=1176&h=885&camefrom=&u=http%3A//wXw.filefactory.com/file/72cjayive7s9/n/DayZ_Bypass_hack_Undetected_.exe&t=DayZ_Bypass_%2B_hack_%5BUndetected%5D.exe%20-%20download%20now%20for%20free.%20File%20sharing.%20Software%20file%20sharing.%20Free%20file%20hosting.%20File%20upload.%20FileFactory.com&java=1&security=d25aa3f1&sc_random=0.31850407685658255&sc_snum=1&p=0&invisible=1”
See attached image - with a unicode replacement character object oriented php outbound connection request…
polonus