Re: [Full-Disclosure] Sears Scam Trojan Code

> being a programmer, I was simply wondering what the content of page.hta
> actually does. I've attached the file as page.txt for anyone who wishes
> to find out; perhaps the results will be interesting. Page.hta can be
> found at http://radnorthgm.com/special/.

The HTA file contains a binary program that seems to be a some sort loader
program. As a first impression, it tries to download something from
cjdra.com via HTTP and run it.

Regards,

--
Jarkko Turkulainen <jt@klake.org>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html