{
  "timestamp": "2025-02-05T23:35:52.221121",
  "content": "Search Free Trial Get Demo Students Targeted by Test Prep SEO Attack April 4, 2017 College entrance exams are anxiety inducing for many students, now made all the more stressful by the discovery by Cyren researchers of malware targeting students seeking an exam reviewer or test preparation service. A recent search for college entrance exam reviewer pdf led to an SEO search engine optimization attack based on these keywords. An SEO attack is designed to attract searchers to the destination webpage containing downloadable or drive-by malware. The malicious webpage is constructed to include the necessary keyword combinations, so that the search engine will rank the page high in search results, increasing the probability that searchers will follow the link. The screens below show two search engines ranking the malicious page high in the search results. Clicking the highlighted search result above will lead to a page like this Clicking the short URL above hxxpshorl.comvivufretrasuste will lead to the download of a RAR archive file named college_entrance_exam_reviewer_with_answer_pdf_dow.rar as seen below The Rar file college_entrance_exam_reviewer_with_answer_pdf_dow.rar contains the file college_entrance_exam_reviewer_with_answer_pdf_dow.exe that shows a compressed archive icon. We detect this as W32FusionCoreDownldr.A.gen!Eldorado. Upon execution of the file college_entrance_exam_reviewer_with_answer_pdf_dow.exe the user is shown the following initialization window while downloading and then loading file window following download below It uses User-Agent  Christmas Mystery and communicates to the server 52.174.48.249 as shown in the code snippet below in order to download a uTorrent program bundled with adware We detect this as W32FusionCoreInstall.A.gen!Eldorado . Upon executing the uTorrent installer bundled with adware, it shows the following step-by-step Windows installation. As a rule of thumb, What You See Isnt Necessarily What You Get . FusionCore poses a security risk to computers. It is an installer which bundles legitimate applications that contain adware, installs toolbars, installs third party applications, or has another unclear purpose. Third party applications are typically installed by default, but users have an option to opt-out of the add-on during or after the installation process. Based on the URL redirection of the short URL hxxpshorl.comvivufretrasuste as seen in the snapshot below. The IP addresses 78.140.165.5 download-performance.com and 88.85.69.163 nottoke.com belongs to AS35415 Webzilla B.V.. We recommend blocking the IP addresses 78.140.165.5 download-performance.com and 88.85.69.163 nottoke.com if you are not already protected by a robust web security service. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Cyren Unified Internet Security Goes Live Point, Click and Hack  Phishers Try Wix Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "categories": [
    "threat_prevention",
    "incident_response"
  ],
  "raw_response": "threat_prevention, incident_response"
}