[Full-Disclosure] Sears Scam Trojan Code

[Jarkko Turkulainen]

> being a programmer, I was simply wondering what the content of page.hta
> actually does.  I've attached the file as page.txt for anyone who wishes
> to find out; perhaps the results will be interesting.  Page.hta can be
> found at  http://radnorthgm.com/special/.

The HTA file contains a binary program that seems to be a some sort loader
program. As a first impression, it tries to download something from
cjdra.com via HTTP and run it.


Regards,

--
Jarkko Turkulainen <jt at klake.org>