CVE-2010-0806 Exploit In The Wild

This report documents active exploitation of Internet Explorer vulnerability CVE-2010-0806: obfuscated JavaScript hosted on cn.cnsa56.info (and a supporting k.js) decodes shellcode which downloads a likely-encrypted payload (v.vkjk6.info/w/win.exe). The payload showed no antivirus detections at the time, the exploit and domains were analyzed with WHOIS/registration details provided, and the author notes probable Chinese-language attribution based on registration/email and variable names.