We at MRG are always amazed about malware writers and operators putting so much work into obfuscating their code and keep everything under the radar. This story started when one of our friends called us, because it turned out his website has been hacked. And this is where our story begins.
The alert
The victim received a mail from Google on April 20, 2014, with subject: “Your AdWords account: Ads not running due to AdWords Advertising Policies”. The redacted content:
“Hello,
We wanted to alert you that one of your sites violates our advertising policies. Therefore, we won’t be able to run any of your ads that link to that site, and any new ads pointing to that site will also be disapproved.
read more..........https://blog.mrg-effitas.com/how-deep-is-the-rabbit-hole-a-tale-about-exploit-kits-and-layers-of-obfuscation/
The alert
The victim received a mail from Google on April 20, 2014, with subject: “Your AdWords account: Ads not running due to AdWords Advertising Policies”. The redacted content:
“Hello,
We wanted to alert you that one of your sites violates our advertising policies. Therefore, we won’t be able to run any of your ads that link to that site, and any new ads pointing to that site will also be disapproved.
read more..........https://blog.mrg-effitas.com/how-deep-is-the-rabbit-hole-a-tale-about-exploit-kits-and-layers-of-obfuscation/