BBB SPAM Dissection

This spam appears to be nothing more than a link to a defaced website.  The source code contains a whole bunch of links to the hacker and his group, including a website and even a Facebook page.  This looks to me like the malicious hacker equivalent of a resume.  People looking to hire a script-kiddie can reach Mr. Black-King through the links contained in the file.  They'd probably be better off hiring somebody else.  His code was full of typos.

Spam includes:  Jquery, YUI, and a bunch of other formatting files.  

Source code from BBB SPAM link:

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
<html xmlns="http://www.w3.org/1999/xhtml">
     
    <meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
    <head>
     <link rel="SHORTCUT ICON" 
href="https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcS50z5gHEhc2MDqtqeAD-rCJjpW87x87ugCXHONBiLajizZcpkljw" type="image/png" rel="icon">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <title></title>
    <script type="text/javascript">
function tb8_makeArray(n){
this.length = n;
return this.length;
}
tb8_messages = new tb8_makeArray(3);
tb8_messages[0] = "Hacked By Black-King";
tb8_messages[1] = "TURK HACK TEAM.Net /Black-King";
tb8_messages[2] = "Zaman Doldu..!";
tb8_rptType = 'infinite';
tb8_rptNbr = 5;
tb8_speed = 100;
tb8_delay = 2000;
var tb8_counter=1;
var tb8_currMsg=0;
var tb8_tekst ="";
var tb8_i=0;
var tb8_TID = null;
function tb8_pisi(){
tb8_tekst = tb8_tekst + tb8_messages[tb8_currMsg].substring(tb8_i, tb8_i+1);
document.title = tb8_tekst;
tb8_sp=tb8_speed;
tb8_i++;
if (tb8_i==tb8_messages[tb8_currMsg].length){
tb8_currMsg++; tb8_i=0; tb8_tekst="";tb8_sp=tb8_delay;
}
if (tb8_currMsg == tb8_messages.length){
if ((tb8_rptType == 'finite') && (tb8_counter==tb8_rptNbr)){
clearTimeout(tb8_TID);
return;
}
tb8_counter++;
tb8_currMsg = 0;
}
tb8_TID = setTimeout("tb8_pisi()", tb8_sp);
}
tb8_pisi()
</script>
    <style type="text/css">body, a, a:hover {cursor: 
url(http://hellox.persiangig.com/DefacePage/negro.cur), progress;}</style>
    <!-- CSS -->
    <link rel="stylesheet" type="text/css" 
href="http://hellox.persiangig.com/DefacePage/jquery00.css" media="all">
    <link rel="stylesheet" type="text/css" 
href="http://hellox.persiangig.com/DefacePage/prettyPh.css" media="all">
    <link rel="stylesheet" type="text/css" 
href="http://hellox.persiangig.com/DefacePage/style000.css" media="all">
     
     
     
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/jquery-1.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/cufon-yu.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/Yanone_K.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/jquery00.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/jquery01.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/jquery02.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/jquery03.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/jquery04.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/jquery05.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/jquery06.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/jquery07.js"></script>
    <script type="text/javascript" 
src="http://hellox.persiangig.com/DefacePage/custom00.js"></script>
    <script type="text/javascript">
      var _gaq = _gaq || [];
      _gaq.push(['_setAccount', 'UA-20402842-6']);
      _gaq.push(['_trackPageview']);
      (function() {
        var ga = document.createElement('script'); ga.type = 'text/javascript'; 
ga.async = true;
        ga.src ='http://hellox.persiangig.com/DefacePage/ga.js';
        var s = document.getElementsByTagName('script')[0]; 
s.parentNode.insertBefore(ga, s);
      })();
    </script><script language="JavaScript" type="text/javascript">
    mensaje = '*<--Hacked by Black-King -->*';font = 'arial';size = 2.5;color = 
'#00FF00';velocidad = 0.6;
    n4 = (document.layers);ie = (document.all);n6 = (document.getElementById);
    mensaje = mensaje.split('');n = mensaje.length;
    a = size*10;ymouse = 0;xmouse = 0;props = "<font face="+font+" color="+color+" 
size="+size+">";
    if (n4){for ( i = 0; i < n; i++)document.write('<layer left="0" top="0" 
width="+a+" name="n4mensaje'+i+'" height="+a+"><center>'+props+mensaje[i]+'</font>
</center></layer>');}else if (ie){document.write('<div id="padre" 
style="position:absolute;top:0px;left:0px"><div style="position:relative">');for 
(i=0; i < n; i++)document.write('<div id="iemensaje" 
style="position:absolute;top:0px;left:0;height:'+a+';width:'+a+';text-
align:center">'+props+mensaje[i]+'</font></div>');document.write('</div>
</div>');}else if (n6){document.write('<div id="padre" 
style="position:absolute;top:0px;left:0px"><div style="position:relative">');for (i = 
0; i < n; i++)document.write('<div id="iemensaje'+i+'" 
style="position:absolute;top:0px;left:0;height:'+a+';width:'+a+';text-
align:center">'+props+mensaje[i]+'</font></div>');document.write('</div></div>');}
    if(n4)window.captureEvents(Event.MOUSEMOVE);
    function Mouse(evento){ if(ie){xmouse = event.x+20;ymouse = event.y+20;}else 
if(n4 || n6){xmouse = evento.pageX+20;ymouse = evento.pageY+20;}}
    if(n4)window.onMouseMove = Mouseelse if(ie || n6)document.onmousemove = Mouse;
    y = new Array();x = new Array();Y = new Array();X = new Array();Yaux = new 
Array();Xaux = new Array();
    for (i=0; i < n; i++){y[i] = 0;x[i] = 0;Y[i] = 0;X[i] = 0;Yaux[i] = 0;Xaux[i] = 
0;}
    function asigna(){if (ie)padre.style.top = document.body.scrollTop;
    for (i = 0; i < n; i++){if(n4){document.layers['n4mensaje'+i].top = 
y[i];document.layers['n4mensaje'+i].left = x[i]+(i*(a/2));}else if(ie)
{iemensaje[i].style.top = y[i];iemensaje[i].style.left = x[i]+(i*(a/2));}else if(n6)
{eval("document.getElementById('iemensaje"+i+"').style.top = 
'"+y[i]+"px'");eval("document.getElementById('iemensaje"+i+"').style.left = '"+(x[i]+
(i*(a/2)))+"px'");} }}
    function ondula(){y[0]=Math.round(Y[0] +=((ymouse)-
Y[0])*velocidad);x[0]=Math.round(X[0] +=((xmouse)-X[0])*velocidad);
    for (var i = 1; i < n; i++){Yaux[i] = Math.round(Y[i]);Xaux[i ]= 
Math.round(X[i]);y[i] = Math.round(Y[i]=Yaux[i]+(y[i-1]-Y[i])*velocidad);x[i] = 
Math.round(X[i]=Xaux[i]+(x[i-1]-
X[i])*velocidad);}asigna();setTimeout('ondula()',50);}
    window.onload = ondula;
    </script>
    </head>
    <body onload="teclear();" oncontextmenu="return false;" onkeydown="return false;" 
onmousedown="return false;">

        <!-- wrappage begin here -->
        <div id="wrappage">
            <!-- container begin here -->

            <div class="container">
                <!-- top block begin here -->
</br>
                             <div class="top">

                 <div class="energy"></div>
                    <div class="top-block">
                        
                    <a class="logo"><font size="15">TURK HACK TEAM</font></a>
                        <div class="bg-e-button"></div>

                         <a href class="open"><img 
src="http://hellox.persiangig.com/DefacePage/flash000.png" alt=""></a>

                        </div>

                </div>

                <!-- top block end here -->
                <!-- center block begin here -->
                <div class="center-block">
                 <!-- &#199;&#211;&#732;&#228;&#209; -->
                 <div class="scanner clearfix">
                  <div class="scanner-block">

                   <div class="scanner-box left">
                    <div class="scanner-line"></div>
                   </div>
                   <ul class="data left">
                    <li class="search">Lutfen Bekleyiniz Sistem Yukleniyor.. </li>
                   </ul>
                               </div>
                 </div>
                    <!-- &#200;&#206;&#212; &#199;&#213;&#225;&#237; -->
                    <div class="main">
                     <div class="load"></div>
                     <div class="shut-left"></div>
                     <div class="shut-right"></div>
                      <div class="page">
                        <div class="box-left left">
                         <div class="info">
                           <ul class="socicon left">
                                               <img src="http://www.turkhackteam.net/customavatars/avatar656657_18.gif" width="100%" 
alt="DotMy" class="right"><center><object type="application/x-shockwave-flash" 
data="http://flash-mp3-player.net/medias/player_mp3_mini.swf" height="20" 
width="200">       <param name="movie" value="http://flash-mp3-
    player.net/medias/player_mp3_mini.swf"> <param name="bgcolor" value="#000000">  
<param name="FlashVars" value="mp3=http://punjabimob.org/downloads-
    11/load/Alphabetical_Hindi_Movies/Alphabet_R/Rang_De_Basanti_
    -_2006/09_-_Rang_De_Basanti_-_Lalkaar_-_
    (PunjabiMob.Com).mp3&amp;autoplay=1&amp;loadingcolor=000000&amp;a
    mp;slidercolo">ee></object></center></br></br >
                    
     
                           </div>
                            <ul id="menu" class="right">
                                <li>
                                  <a href="#msg" class="selected">Duyurum</a>
                                                                   <a href="#about"
     

class="selected">Hakkimda</a>
                                                             
                                </li>
                              </ul>

                        </div>
     


                            <div class="cont left">
                            <!-- &#227;&#228;&#230;&#229;&#199; -->
                                <div id="msg" class="box left">
                                            <div class="box-content">
                                            <h3><font color="green">TurkHackTeam.Net</font></h3>
                                            
                                            <p class="sub"><font color="#800000">TURKHACKTEAM - Black-King</font></p>
     
                                            
                                            <p><strong><font color="white">Merhaba Sayin Admin. TurkHackerTeam Black-King Tarafindan Hacklandiniz.
Sisteminizi Elegecirmeyi istemedim. Ama Buna Mecburdum. Ya Ben Bu Yanlis Giden Dunya Duzenine Dur Diyecegim.
Yada Dunya Oldugu Gibi Kotuluge Baticakti.
Evet Dunya Barisini istiyoruz.
Biz Bunu Sanalda Sagliyoruz.
Ama Reel icinde Ugrasiyoruz
Amacimiz Pisikolojik Savas Yaratmaktir. Bu Savasi Turkler Kazanacaktir...
Cunki Biz Sanal Alemin krallariyiz. Bunu Herkez Bilir.
<font color="red"><center>By Selam Heke Devam...</center></font>
 </font></strong></p>
                                            
<p>==================================================================================
</p>
                                           
                                            
                                       <center>     <p><strong><font color="red">www.turkhackteam.net /org bekleniyorsunuz. /Black-King/.</font></strong></p> </center>
                                            
<p>==================================================================================

<b><p><strong><font color="white">Biz Kimmiyiz ?  iste Bizim Listemiz
ZoRRoKiN-Elazigli168-3333-Bedros Sanches
Black-Box-Genghis Khan-SaMuRai-NightWolf-Ra's al Ghul
secWorm-_EroS_ -INFeRNaL-DelPhoi
'Ghost Warrior-Solo-Turk-SaLii-_RoC_
Black-King
Daha Fazlasi icin TurkHackTeam.Net </center>  </font></strong></p></b>


</p>
                                            </div>
                    </div>
                                   
                                   
                    <div id="sysinfo" class="box left">
                                            <div class="box-content">
                                            <h3><font color="red">System Info</font>
</h3>
                                            <p class="sub"><font 
color="#42413E">Server Kernel</font></p>
                                           
                                            <strong><font color="gold">Linux 
macan.fastnsecure.net 2.6.18-408.el5.lve0.8.58 #1 SMP Wed Mar 14 14:10:01 EDT 2012 
x86_64</font></strong></br>
                                           
                                            </div>
                    </div>
                                   
                                   
                                    <div id="about" class="box left">
                                            <div class="box-content">
                                            <center><h3><font color="red">Black-King Hakkinda !</font></h3>
                                            <p class="sub"><font color="gold">Www.TurkHackTeam.Net / Org 
kamkam50-turkhackteam.blogspot.com
www.facebook.com/TurkHackTeamKamKam
Ziyaretimize Bekleriz.
Hakkimizda Olan Sorularinizi Bana Degil , cevreme soracaksiniz.
Coded By Black-King </font></p>
                                           
                                            <strong><font color="red"> 
</font></strong></br>
                                            <p><strong><font color="white"></font></strong></p>
    
     
                                           
                                           
                                            <strong><font color="red">TurkHackTeam Yöneticileri

<p>==================================================================================

<b><p><strong><font color="white">Biz Kimmiyiz ?  iste Bizim Listemiz
ZoRRoKiN-Elazigli168-3333-Bedros Sanches
Black-Box-Genghis Khan-SaMuRai-NightWolf-Ra's al Ghul
secWorm-_EroS_ -INFeRNaL-DelPhoi
'Ghost Warrior-Solo-Turk-SaLii-_RoC_
Black-King
Daha Fazlasi icin TurkHackTeam.Net </center>  </font></strong></p></b>


</p>


</font></strong></center></br>
                                            <p><strong><marquee direction="left" 
scrollamount="5" scrolldelay="100" width="100%"><font color="#00FF00"> Hacked By Black-King TurkHackTeam.Net </font></marquee></strong></p>
                                                                   
                                            </div>
                    </div>
                                   
                                    <div id="music" class="box left">
                                            <div class="box-content">
                                            <h3><font color="red">Muzik</font>
</h3>
                                            <p class="sub"><font color="#42413E">Müzik</font></p>
                                           
                                            <strong><font color="green">In the End - 
Linkin Park</font></strong></br>
                                            </div>
                    </div>
                                   
     
                    <div id="irc" class="box left">
                                <div class="box-content">
                                </div>
                            </div>
                        </div>
                      </div>
                    </div>
                </div>
                <div class="bottom">
                    <div class="bottom-block">
                        <h4class="left">Hacked by Black-King</h4>
                    </div>
                </div>
            </div>
        </div>
<pre><embed src="http://www.youtube.com/v/gg9hcNObRP8&amp;autoplay=1" 
type="application/x-shockwave-flash" loop="true" wmode="transparent" width="1" 
height="1" __idm_id__="-1582612479" ></pre>
<pre><embed src="http://www.youtube.com/v/rqbwiLY277I&amp;autoplay=1" 
type="application/x-shockwave-flash" loop="true" wmode="transparent" width="1" 
height="1" __idm_id__="-1582612479" ></pre>
 </body>
    </html>
This logo gets pulled down from a google (gstatic) server.  Virustotal.com doesn't think it's malicious.  It's just a hacker logo.

This logo gets pulled down from a google (gstatic) server.  Virustotal.com doesn't think it's malicious.  It's just a hacker logo.