To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.
Malware Overview
This is the Trend Micro detection for HTML pages and compromised Web sites that contain malicious iFrame tags.
It is known to be hosted on the following URL:
- http://77.221.{BLOCKED}.188/.if/go.html
Once an unsuspecting user visits or views an affected Web page, this malicious HTML connects to certain URLs to download a possibly malicious file. As a result, routines of the downloaded file are also exhibited on the affected system.