Why is this script detected as suspicious?
Posted: Thu Jun 10, 2010 6:27 pm
Hi forum friends,
Just for the fun of it I gave in the code of a very well know Dutch site into jsunpack, I was startled to find some suspicious code on that website:
http://jsunpack.jeek.org/dec/go?report= ... 6dc70c6a54
and well here: www.buienradar.nl/ScriptResource.axd?d=etc.....
Well, heavily obfuscated, but it seems given as benign: http://wepawet.iseclab.org/view.php?has ... 33&type=js
avast webshield comes upwith a JS:Pdfka-WI [Expl] flag, which was found to be a FP here: http://forum.avast.com/index.php?topic=43660.0
Who can give the final verdict?
luntrus
Just for the fun of it I gave in the code of a very well know Dutch site into jsunpack, I was startled to find some suspicious code on that website:
http://jsunpack.jeek.org/dec/go?report= ... 6dc70c6a54
and well here: www.buienradar.nl/ScriptResource.axd?d=etc.....
Well, heavily obfuscated, but it seems given as benign: http://wepawet.iseclab.org/view.php?has ... 33&type=js
avast webshield comes upwith a JS:Pdfka-WI [Expl] flag, which was found to be a FP here: http://forum.avast.com/index.php?topic=43660.0
Who can give the final verdict?
luntrus