CLARIFICATION: I changed the title as people were interpreting this as a request to help understand the code. I explain what the code is doing below (critiques on this analysis are welcome.) I am trying to figure out why it's doing this. I have proposed some theories, looking for other ideas.
I received and email through my work server with the following title: "Changed state transfer 3310DHIFM" with an .doc attachment. Clearly this is an attempt to install a virus and I decided to see what exactly was in this file. I saved it as text and opened it in an editor that I know doesn't "help" by trying to open things in the "right" program. What I found was an HTML page. The header basically pulls down resources from a Lithuanian news website that appears to be legitimate. It's possible that it has been compromised so I have changed the web addresses to not work in a way that should be obvious.
Please don't follow those links unless you really know what you are doing! I an not responsible for any negative consequences that result from you trying to access these resources
After pulling a version of jquery from that site, it then has a script that uses it:
Basically it looks for any link that has the word fortinet in it and then puts that changes the href in the below html to point to that fortinet link and hides the actual fortinet link.
There's some text in Lithuanian (mangled by my editor, it seems) about how a virus was blocked etc. and then a link to more information about the virus. That is where the fortinet link is placed by the script.
<body style="padding:50px;"> <div id="tapsauga-msg"> <div id="tapsauga-msg-inner"> <table> <tr> <td width="80" align="center" valign="top"><img src="http://ww2.zebra.eeltee/i/internetas/error_48.png"></td> <td colspan="2"> TEO paslauga â€žTriguba apsaugaâ€ť aptiko ir uĹľblokavo virusu "WM/Agent!tr" uĹľkrÄ—stÄ… bylÄ…. Paslauga â€žTriguba apsaugaâ€ť draudĹľia atsisiĹłsti ĹˇiÄ… bylÄ…, nes ji gali pakenkti JĹ«sĹł kompiuteriui. </td> </tr> <tr><td colspan="3"> </td></tr> <tr> <td></td> <td align="left" colspan="2"> <a class="uzsisakyk_big_grey" href="nuoroda">Daugiau apie virusÄ…</a> </td> </tr> </table> </div> </div> </body> </html>
Does anyone understand why it's doing this? I can't see how this accomplishes much unless there's something funky in the jquery script or the css files pulled from the zebra site.
It seems like it's targeting people using a fortinet firewall but for what purpose? I can hazard a guess that maybe it's trying to grab a link that allows something that was blocked to be accessed but I don't see what that accomplishes. There doesn't seem to be anything else here that's it's trying to bring into the page. Is there a Word vulnerability around HTML? A quirks-mode vulnerability? It seems pretty ineffectual but I could be underestimating the author.
I looked at the css files in the links and I see that there are many gifs and jpgs references. Another possibility is that there is a flaw the the way Word handles gifs or jpgs.