Another Spam Email Redirecting Host to Forskolin Pages

Email found in my inbox:

Clicking on the link generated the following HTTP traffic:


As you can see this is the same sort of traffic I saw in my previous blog post. The redirect (lhdjzr[.]com/?c=wl) contains an obfuscated script that has been encoded and reversed. Once reversed, decoded and deobfuscated you can see how the script works. For more information about these spam emails click here.

Associated SHA256s

Hybrid Analysis:


Recommend blocking: – Domains –  Domains – Domains


Just a normal person who spends their free time infecting systems with malware.

Leave a Comment

%d bloggers like this: