2

I am getting a mail from crontab and can't identify the source of it.

My site is brand-new so I am not sure what this is doing or its purpose. Is it some hack?

<html>
<head>
<META NAME="robots" CONTENT="noindex,nofollow">
<script>
(function() {  function getSessionCookies() {   cookieArray = new Array();   var cName = /^\s?incap_ses_/;   var c = document.cookie.split(";");   for (var i = 0; i < c.length; i++) {    key = c[i].substr(0, c[i].indexOf("="));    value = c[i].substr(c[i].indexOf("=") + 1, c[i].length);    if (cName.test(key)) {     cookieArray[cookieArray.length] = value    }   }   return cookieArray  }  function setIncapCookie(vArray) {   try {    cookies = getSessionCookies();    digests = new Array(cookies.length);    for (var i = 0; i < cookies.length; i++) {     digests[i] = simpleDigest((vArray) + cookies[i])    }    res = vArray + ",digest=" + (digests.join())   } catch (e) {    res = vArray + ",digest=" + (encodeURIComponent(e.toString()))   }   createCookie("___utmvc", res, 20)  }  function simpleDigest(mystr) {   var res = 0;   for (var i = 0; i < mystr.length; i++) {    res += mystr.charCodeAt(i)   }   return res  }  function createCookie(name, value, seconds) {   if (seconds) {    var date = new Date();    date.setTime(date.getTime() + (seconds * 1000));    var expires = "; expires=" + date.toGMTString()   } else {    var expires = ""   }   document.cookie = name + "=" + value + expires + "; path=/"  }  function test(o) {   var res = "";   var vArray = new Array();   for (var j = 0; j < o.length; j++) {    var test = o[j][0]    switch (o[j][1]) {    case "exists_boolean":     try {         if(typeof(eval(test)) != "undefined"){                 vArray[vArray.length] = encodeURIComponent(test + "=true")       }       else{          vArray[vArray.length] = encodeURIComponent(test + "=false")      }     } catch (e) {      vArray[vArray.length] = encodeURIComponent(test + "=false")     }     break;    case "exists":     try {      vArray[vArray.length] = encodeURIComponent(test + "=" + typeof(eval(test)))     } catch (e) {      vArray[vArray.length] = encodeURIComponent(test + "=" + e)     }     break;    case "value":     try {      vArray[vArray.length] = encodeURIComponent(test + "=" + eval(test).toString())     } catch (e) {      vArray[vArray.length] = encodeURIComponent(test + "=" + e)     }     break;     case "plugins":     try{         p=navigator.plugins         pres=""         for (a in p){pres+=(p[a]['description']+" ").substring(0,20)}         vArray[vArray.length] = encodeURIComponent("plugins=" + pres);         }     catch(e){         vArray[vArray.length] = encodeURIComponent("plugins=" +e);         }     break;      case "plugin":     try {      a = navigator.plugins;      for (i in a) {       f = a[i]["filename"].split(".");       if (f.length == 2) {        vArray[vArray.length] = encodeURIComponent("plugin=" + f[1]);        break       }      }     } catch (e) {      vArray[vArray.length] = encodeURIComponent("plugin=" + e)     }     break    }   }   vArray = vArray.join();   return vArray  }  var o = [   ["navigator", "exists_boolean"],   ["navigator.vendor", "value"],   ["opera", "exists_boolean"],   ["ActiveXObject", "exists_boolean"],   ["navigator.appName", "value"],   ["platform", "plugin"],   ["webkitURL", "exists_boolean"],   ["navigator.plugins.length==0", "value"],   ["_phantom", "exists_boolean"] ];  try {   setIncapCookie(test(o));   document.createElement("img").src = "/_Incapsula_Resource?SWKMTFSR=1&e=" + Math.random()  } catch (e) {   img = document.createElement("img");   img.src = "/_Incapsula_Resource?SWKMTFSR=1&e=" + e  } })();
</script>
<script>
(function() {
var z="";var b="7472797B766172207868723B76617220743D6E6577204461746528292E67657454696D6528293B766172207374617475733D227374617274223B7661722074696D696E673D6E65772041727261792833293B77696E646F772E6F6E756E6C6F61643D66756E6374696F6E28297B74696D696E675B325D3D22723A222B286E6577204461746528292E67657454696D6528292D74293B646F63756D656E742E637265617465456C656D656E742822696D6722292E7372633D222F5F496E63617073756C615F5265736F757263653F4553324C555243543D363726743D373826643D222B656E636F6465555249436F6D706F6E656E74287374617475732B222028222B74696D696E672E6A6F696E28292B222922297D3B69662877696E646F772E584D4C4874747052657175657374297B7868723D6E657720584D4C48747470526571756573747D656C73657B7868723D6E657720416374697665584F626A65637428224D6963726F736F66742E584D4C4854545022297D7868722E6F6E726561647973746174656368616E67653D66756E6374696F6E28297B737769746368287868722E72656164795374617465297B6361736520303A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2072657175657374206E6F7420696E697469616C697A656420223B627265616B3B6361736520313A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2073657276657220636F6E6E656374696F6E2065737461626C6973686564223B627265616B3B6361736520323A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2072657175657374207265636569766564223B627265616B3B6361736520333A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2070726F63657373696E672072657175657374223B627265616B3B6361736520343A7374617475733D22636F6D706C657465223B74696D696E675B315D3D22633A222B286E6577204461746528292E67657454696D6528292D74293B6966287868722E7374617475733D3D323030297B706172656E742E6C6F636174696F6E2E72656C6F616428297D627265616B7D7D3B74696D696E675B305D3D22733A222B286E6577204461746528292E67657454696D6528292D74293B7868722E6F70656E2822474554222C222F5F496E63617073756C615F5265736F757263653F535748414E45444C3D34333535313230313036373534333635382C333232323436343739313335393039303132362C373638333038363331313835353338393137332C343234353633222C66616C7365293B7868722E73656E64286E756C6C297D63617463682863297B7374617475732B3D6E6577204461746528292E67657454696D6528292D742B2220696E6361705F6578633A20222B633B646F63756D656E742E637265617465456C656D656E742822696D6722292E7372633D222F5F496E63617073756C615F5265736F757263653F4553324C555243543D363726743D373826643D222B656E636F6465555249436F6D706F6E656E74287374617475732B222028222B74696D696E672E6A6F696E28292B222922297D3B";for (var i=0;i<b.length;i+=2){z=z+parseInt(b.substring(i, i+2), 16)+",";}z = z.substring(0,z.length-1); eval(eval('String.fromCharCode('+z+')'));})();
</script></head>
<body>
<iframe style="display:none;visibility:hidden;" src="//content.incapsula.com/jsTest.html" id="gaIframe"></iframe>
</body></html>
Improve this question
2
  • yes, this is malicious code - why do you say that it is from crontab?
    – schroeder ♦
    Jan 19, 2016 at 18:15
  • This is not malicious code. This is part of your DDOS protection. Refer to my comment on Mark's answer for a breakdown of what the JavaScript is attempting to do.
    – Bacon Brad
    Jan 19, 2016 at 19:49

1 Answer 1

Reset to default
4

I can't help with why this is happening. There could be too many reasons. However, I can tell you what it's doing:

It has a large list of numbers (var b) which are actually stored character codes. The program splits them up into var z like this:

116,114,121,123,118,97,114,32,120,104,114,59,118,97,114,32,116,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,59,118,97,114,32,115,116,97,116,117,115,61,34,115,116,97,114,116,34,59,118,97,114,32,116,105,109,105,110,103,61,110,101,119,32,65,114,114,97,121,40,51,41,59,119,105,110,100,111,119,46,111,110,117,110,108,111,97,100,61,102,117,110,99,116,105,111,110,40,41,123,116,105,109,105,110,103,91,50,93,61,34,114,58,34,43,40,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,41,59,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,105,109,103,34,41,46,115,114,99,61,34,47,95,73,110,99,97,112,115,117,108,97,95,82,101,115,111,117,114,99,101,63,69,83,50,76,85,82,67,84,61,54,55,38,116,61,55,56,38,100,61,34,43,101,110,99,111,100,101,85,82,73,67,111,109,112,111,110,101,110,116,40,115,116,97,116,117,115,43,34,32,40,34,43,116,105,109,105,110,103,46,106,111,105,110,40,41,43,34,41,34,41,125,59,105,102,40,119,105,110,100,111,119,46,88,77,76,72,116,116,112,82,101,113,117,101,115,116,41,123,120,104,114,61,110,101,119,32,88,77,76,72,116,116,112,82,101,113,117,101,115,116,125,101,108,115,101,123,120,104,114,61,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,34,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,34,41,125,120,104,114,46,111,110,114,101,97,100,121,115,116,97,116,101,99,104,97,110,103,101,61,102,117,110,99,116,105,111,110,40,41,123,115,119,105,116,99,104,40,120,104,114,46,114,101,97,100,121,83,116,97,116,101,41,123,99,97,115,101,32,48,58,115,116,97,116,117,115,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,58,32,114,101,113,117,101,115,116,32,110,111,116,32,105,110,105,116,105,97,108,105,122,101,100,32,34,59,98,114,101,97,107,59,99,97,115,101,32,49,58,115,116,97,116,117,115,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,58,32,115,101,114,118,101,114,32,99,111,110,110,101,99,116,105,111,110,32,101,115,116,97,98,108,105,115,104,101,100,34,59,98,114,101,97,107,59,99,97,115,101,32,50,58,115,116,97,116,117,115,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,58,32,114,101,113,117,101,115,116,32,114,101,99,101,105,118,101,100,34,59,98,114,101,97,107,59,99,97,115,101,32,51,58,115,116,97,116,117,115,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,58,32,112,114,111,99,101,115,115,105,110,103,32,114,101,113,117,101,115,116,34,59,98,114,101,97,107,59,99,97,115,101,32,52,58,115,116,97,116,117,115,61,34,99,111,109,112,108,101,116,101,34,59,116,105,109,105,110,103,91,49,93,61,34,99,58,34,43,40,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,41,59,105,102,40,120,104,114,46,115,116,97,116,117,115,61,61,50,48,48,41,123,112,97,114,101,110,116,46,108,111,99,97,116,105,111,110,46,114,101,108,111,97,100,40,41,125,98,114,101,97,107,125,125,59,116,105,109,105,110,103,91,48,93,61,34,115,58,34,43,40,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,41,59,120,104,114,46,111,112,101,110,40,34,71,69,84,34,44,34,47,95,73,110,99,97,112,115,117,108,97,95,82,101,115,111,117,114,99,101,63,83,87,72,65,78,69,68,76,61,52,51,53,53,49,50,48,49,48,54,55,53,52,51,54,53,56,44,51,50,50,50,52,54,52,55,57,49,51,53,57,48,57,48,49,50,54,44,55,54,56,51,48,56,54,51,49,49,56,53,53,51,56,57,49,55,51,44,52,50,52,53,54,51,34,44,102,97,108,115,101,41,59,120,104,114,46,115,101,110,100,40,110,117,108,108,41,125,99,97,116,99,104,40,99,41,123,115,116,97,116,117,115,43,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,32,105,110,99,97,112,95,101,120,99,58,32,34,43,99,59,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,105,109,103,34,41,46,115,114,99,61,34,47,95,73,110,99,97,112,115,117,108,97,95,82,101,115,111,117,114,99,101,63,69,83,50,76,85,82,67,84,61,54,55,38,116,61,55,56,38,100,61,34,43,101,110,99,111,100,101,85,82,73,67,111,109,112,111,110,101,110,116,40,115,116,97,116,117,115,43,34,32,40,34,43,116,105,109,105,110,103,46,106,111,105,110,40,41,43,34,41,34,41,125,59

After that, it tries to get the character code for each number in the string. For example, character 32 = space. This produces the following output: 

   try {
       var xhr;
       var t = new Date().getTime();
       var status = "start";
       var timing = new Array(3);
       window.onunload = function() {
           timing[2] = "r:" + (new Date().getTime() - t);
           document.createElement("img").src = "/_Incapsula_Resource?ES2LURCT=67&t=78&d=" + encodeURIComponent(status + " (" + timing.join() + ")")
       };
       if (window.XMLHttpRequest) {
           xhr = new XMLHttpRequest
       } else {
           xhr = new ActiveXObject("Microsoft.XMLHTTP")
       }
       xhr.onreadystatechange = function() {
           switch (xhr.readyState) {
               case 0:
                   status = new Date().getTime() - t + ": request not initialized ";
                   break;
               case 1:
                   status = new Date().getTime() - t + ": server connection established";
                   break;
               case 2:
                   status = new Date().getTime() - t + ": request received";
                   break;
               case 3:
                   status = new Date().getTime() - t + ": processing request";
                   break;
               case 4:
                   status = "complete";
                   timing[1] = "c:" + (new Date().getTime() - t);
                   if (xhr.status == 200) {
                       parent.location.reload()
                   }
                   break
           }
       };
       timing[0] = "s:" + (new Date().getTime() - t);
       xhr.open("GET", "/_Incapsula_Resource?SWHANEDL=43551201067543658,3222464791359090126,7683086311855389173,424563", false);
       xhr.send(null)
   } catch (c) {
       status += new Date().getTime() - t + " incap_exc: " + c;
       document.createElement("img").src = "/_Incapsula_Resource?ES2LURCT=67&t=78&d=" + encodeURIComponent(status + " (" + timing.join() + ")")
   }

...and then tries to send information to a website.

[tinfoil hattery ensues]

This appears to be legitimate, but...

Are you a normal user, or are you the admin? If you're the admin, and you don't know why this is there, then I would not trust this. It does lead back to a supposedly legitimate company that provides IT security solutions, Incapsula. However, I question any company that finds a need to go to such extreme lengths to obfuscate their javascript. In my opinion, any company worth their salt would not try to do this as it only took me 30 seconds to unravel.

This stops short of actually running anything, though. It seems to be trying to embed an image, which can also be used as a tracking cookie for every email you send. Every time you load, or unload the page, it embeds a tracking image.

Too Long, Didn't Read

  1. Converts long number string to separated number string.
  2. Converts comma-delimited string of numbers to ASCII character codes
  3. Attempts to run script using embedded eval(). Seems to target the user based on their specific web-browser (first <script></script> tags).
  4. Creates an XMLHttpRequest, or ActiveX Object (!)
  5. Every time the user loads the file, it displays the contents as an image. This can be used for tracking purposes.
  6. Every time you close the window, it does the same. They know when you open the window, and when you close the window.
Improve this answer
6
  • 2
    My theory here based on the JavaScript is the obfuscation is an attempt to prevent it from being easily stripped from the requested content. The script when executed attempts to request to their servers. If the attempt fails then the image is implanted as a secondary attempt to collect information. When you connect to the server displaying the image you send information like your IP, user agent, referral, etc. And in this case connection times. This is a similar tactic to get information used by legitimate web analytics. From what it appears this script is likely not meant to be malicious.
    – Bacon Brad
    Jan 19, 2016 at 19:30
  • 1
    @BradMetcalf Yeah, I just went through the code and updated it with that information before I saw your reply. I agree that it doesn't really seem to be malicious, it seems to mostly be tracking stuff. However, OP doesn't seem to know why it's there on his own website, and for some weird reason, crontab is sending him this!
    – Mark Buffalo
    Jan 19, 2016 at 19:32
  • Hi Mark, Brad.. Thanks for taking time and guiding me with this .. I did purchase a subscription from SiteLock but Not sure if its related as mails started coming 3 days back and my Subscription is now two months old The Reason I mention that this is from Cron is due to the Subject of the Mail From: Cron Daemon <[email protected]> Date: Tue, Jan 19, 2016 at 12:30 PM Subject: Cron <myhost@server> /usr/bin/wget -O - -q mysitename.com/cron.php ...................................................................... But It really relieves me to know this is not something malicious.
    – Vaibhav Mishra
    Jan 19, 2016 at 19:57
  • @BradMetcalf Now I'm even more suspicious. Look at this post. It tries to do the same thing with URLs on this script by embedding an image... hm.... gonna look into this some more.
    – Mark Buffalo
    Jan 20, 2016 at 1:08
  • @mark-buffalo that script is totally unrelated to this one. Obfuscation is seen in many places and can be used legitimately or malicious. What that script you referenced is completely different. It is trying to display a URL as an image in an attempt to get them to execute it. That URL is to try and modify router settings. The URL in this script isn't doing such a thing.
    – Bacon Brad
    Jan 20, 2016 at 17:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .