Re: Sears Scam Trojan Code

[Jarkko Turkulainen <jt () klake org>]

> being a programmer, I was simply wondering what the content of page.hta
> actually does.  I've attached the file as page.txt for anyone who wishes
> to find out; perhaps the results will be interesting.  Page.hta can be
> found at  http://radnorthgm.com/special/.

The HTA file contains a binary program that seems to be a some sort loader
program. As a first impression, it tries to download something from
cjdra.com via HTTP and run it.


Regards,

--
Jarkko Turkulainen <jt () klake org>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html