1

Here is a link from an SMS I received abev1o.yzv.jp.

This link redirects to a somewhat random website (twitter, youtube, CNN, and others).

I downloaded the page using curl:

https://gist.github.com/serega/aab933c9104e92f189b8692912f02a52

It looks like the code is using window.location. The websites the script redirects to seem to be legit. What is the purpose of this?

5
  • 1
    The script sets cookies and sends people off somewhere else... As for why? Maybe it's an altruistic AI sent from 800 years in the future to subtly influence humanity to bring about a true post-scarcity society. (We don't know why, and any conjecture on our point is just conjecture.)
    – Ghedipunk
    Commented Dec 11, 2019 at 21:25
  • you are asking "why" for some lines in the code, or purpose of such program (you can modify "random" direct to "specific" direct of course)? now it seems not a security-related question?
    – TJCLK
    Commented Dec 12, 2019 at 11:00
  • Decoding random code on random sites is not really what we do here. We would be flooded with randomness. I'm not sure what any answer would tell you, either. The code you posted does not show any redirect code. So there's a lot missing, too.
    – schroeder
    Commented Dec 12, 2019 at 12:57
  • To know the purpose, you need to know everything it is doing. To do that, you need to analyse the behaviours and the code. There are many online tools that analyse behaviours.
    – schroeder
    Commented Dec 12, 2019 at 13:07
  • I ran the link through Cuckoo sandbox, and it is a malware/ransomware dropper: cuckoo.ee/analysis/1464559/summary
    – schroeder
    Commented Dec 12, 2019 at 13:12

0

Browse other questions tagged .