1

CLARIFICATION: I changed the title as people were interpreting this as a request to help understand the code. I explain what the code is doing below (critiques on this analysis are welcome.) I am trying to figure out why it's doing this. I have proposed some theories, looking for other ideas.

I received and email through my work server with the following title: "Changed state transfer 3310DHIFM" with an .doc attachment. Clearly this is an attempt to install a virus and I decided to see what exactly was in this file. I saved it as text and opened it in an editor that I know doesn't "help" by trying to open things in the "right" program. What I found was an HTML page. The header basically pulls down resources from a Lithuanian news website that appears to be legitimate. It's possible that it has been compromised so I have changed the web addresses to not work in a way that should be obvious.

Please don't follow those links unless you really know what you are doing! I an not responsible for any negative consequences that result from you trying to access these resources

After pulling a version of jquery from that site, it then has a script that uses it:

    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
    <html>
       <head>
          <title></title>
          <meta http-equiv="content-type" content="text/html; charset=windows-1250">
          <meta name="generator">
          <LINK rel="stylesheet" type="text/css" href="http://ww2.zebra.eeltee/c/internetas/style.css">
          <LINK rel="stylesheet" type="text/css" href="http://ww2.zebra.eeltee/c/internetas/tapsauga.css">
          <script type="text/javascript" src="http://ww2.zebra.eeltee/js/jquery.js"></script>
          <script type="text/javascript">
            $(document).ready(function () {
              fortinet = $("a[href*='fortinet']");
              $("a.uzsisakyk_big_grey").attr("href", fortinet.attr("href"));
              fortinet.hide();
            });
          </script>
        </head>

Basically it looks for any link that has the word fortinet in it and then puts that changes the href in the below html to point to that fortinet link and hides the actual fortinet link.

There's some text in Lithuanian (mangled by my editor, it seems) about how a virus was blocked etc. and then a link to more information about the virus. That is where the fortinet link is placed by the script.

      <body style="padding:50px;">
        <div id="tapsauga-msg">
          <div id="tapsauga-msg-inner">

            <table>
              <tr>
                <td width="80" align="center" valign="top"><img src="http://ww2.zebra.eeltee/i/internetas/error_48.png"></td>
                <td colspan="2">
          TEO paslauga „Triguba apsauga” aptiko ir užblokavo virusu "WM/Agent!tr" užkrėstą bylą. Paslauga „Triguba apsauga” draudžia atsisiųsti šią bylą, nes ji gali pakenkti Jūsų kompiuteriui.
                </td>
              </tr>
              <tr><td colspan="3"> </td></tr>
              <tr>
                <td></td>
                <td align="left" colspan="2">
                  <a class="uzsisakyk_big_grey" href="nuoroda">Daugiau apie virusÄ…</a>
                </td>
              </tr>
            </table>
          </div>
        </div>
      </body>
    </html>

Does anyone understand why it's doing this? I can't see how this accomplishes much unless there's something funky in the jquery script or the css files pulled from the zebra site.

It seems like it's targeting people using a fortinet firewall but for what purpose? I can hazard a guess that maybe it's trying to grab a link that allows something that was blocked to be accessed but I don't see what that accomplishes. There doesn't seem to be anything else here that's it's trying to bring into the page. Is there a Word vulnerability around HTML? A quirks-mode vulnerability? It seems pretty ineffectual but I could be underestimating the author.

EDIT:

I looked at the css files in the links and I see that there are many gifs and jpgs references. Another possibility is that there is a flaw the the way Word handles gifs or jpgs.

  • 2
    Trying to understand virus code is beyond the scope of the site. At this point, I do not think there is a SE site that handles this type of question. – schroeder Oct 22 '15 at 17:39
  • Thanks for your response. So how do I go about asking for a new SE site for "Software Security" to be created? – JimmyJames Oct 22 '15 at 18:05
  • are you sure it's not just a fortinet device that replaced the malicious content with a warning message before the email was sent? – Jay Oct 22 '15 at 18:18
  • This is the uninterpreted source above. I didn't view this in Word or any browser. I'm simply describing what the script does from it's text. $("a[href*='fortinet']") searches for a link containing the work "fortinet". Then $("a.uzsisakyk_big_grey").attr("href", fortinet.attr("href")); replaces the link in the table below with that target. Then it hides the original fortinet link: fortinet.hide(); – JimmyJames Oct 22 '15 at 18:43
  • I reread your comment and I think what you are asking is whether fortinet may have taken the document, understood it to be HTML and then inserted a new script with warnings written in Lithuanian. I suppose that's possible but we don't use fortinet at my organization. – JimmyJames Oct 22 '15 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.