JS/Redirector.KRP!tr

Analysis

JS/Redirector.KRP!tr is the detection for encoded Javascript codes which try to download another script file from the following URL:

• http://queodaesahpiabie.in:3129/js

The downloaded script file contains some embedded exploit modules for Adobe Acrobat and Reader, which contain some shellcode that tries to download and execute a file. As of this writing, the file is downloaded from the following URL:

• http://eizuechijiabotho.in:3126/download/banner.php?spl=pdf_2011

This executable file can be detected as W32/FraudPack.ANWL!tr.

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
  FortiClient Systems
  
• Quarantine/delete files that are detected and replace infected files with clean backup copies.