What does this javascript file do? Is this a virus?

Question

While searching on Google I found a website that shows one set of content to the Google Bot and an other to users (by redirecting to a new domain), and also a very suspicious Javascript file. Maybe it's a tracking cookie or a virus/malware, I don't know, so I am asking here if someone can help explain the code?

If the site is "safe" why does it redirect a search engine to a normal website, and users to a blank page by loading this .js file? Why should it have a getpassword.asp hosted on the second redirected domain (from sucuri scan) ?

document.write ('<a href="" target="_blank"><img alt="&#x35;&#x31;&#x2E;&#x6C;&#x61;&#x20;&#x4E13;&#x4E1A;&#x3001;&#x514D;&#x8D39;&#x3001;&#x5F3A;&#x5065;&#x7684;&#x8BBF;&#x95EE;&#x7EDF;&#x8BA1;" src="" style="" /></a>\n');
var a1156tf="51la";var a1156pu="";var a1156pf="51la";var a1156su=window.location;var a1156sf=document.referrer;var a1156of="";var a1156op="";var a1156ops=1;var a1156ot=1;var a1156d=new Date();var a1156color="";if (navigator.appName=="Netscape"){a1156color=screen.pixelDepth;} else {a1156color=screen.colorDepth;}
try{a1156tf=top.document.referrer;}catch(e){}
try{a1156pu =window.parent.location;}catch(e){}
try{a1156pf=window.parent.document.referrer;}catch(e){}
try{a1156ops=document.cookie.match(new RegExp("(^| )a1156_pages=([^;]*)(;|$)"));a1156ops=(a1156ops==null)?1: (parseInt(unescape((a1156ops)[2]))+1);var a1156oe =new Date();a1156oe.setTime(a1156oe.getTime()+60*60*1000);document.cookie="a1156_pages="+a1156ops+ ";path=/;expires="+a1156oe.toGMTString();a1156ot=document.cookie.match(new RegExp("(^| )a1156_times=([^;]*)(;|$)"));if(a1156ot==null){a1156ot=1;}else{a1156ot=parseInt(unescape((a1156ot)[2])); a1156ot=(a1156ops==1)?(a1156ot+1):(a1156ot);}a1156oe.setTime(a1156oe.getTime()+365*24*60*60*1000);document.cookie="a1156_times="+a1156ot+";path=/;expires="+a1156oe.toGMTString();}catch(e){}
try{if(document.cookie==""){a1156ops=-1;a1156ot=-1;}}catch(e){}
a1156of=a1156sf;if(a1156pf!=="51la"){a1156of=a1156pf;}if(a1156tf!=="51la"){a1156of=a1156tf;}a1156op=a1156pu;try{lainframe}catch(e){a1156op=a1156su;}
a1156src='(0-a1156d.getTimezoneOffset()/60)+'&tcolor='+a1156color+'&sSize='+screen.width+','+screen.height+'&referrer='+escape(a1156of)+'&vpage='+escape(a1156op)+'&vvtime='+a1156d.getTime();
setTimeout('a1156img = new Image;a1156img.src=a1156src;',0);

Answer 1

Let's clean this up and look at it more closely, I've also replaced some HTML entities with their text equivalent:

Add a linked image to the page, Chinese characters were encoded but I don't think this is suspicious:

document.write('<a href="http://www.51.la/?17211156" target="_blank"><img alt="51.la 专业、免费、强健的访问统计" src="http://icon.ajiang.net/icon_8.gif" style="border:none" /></a>\n');

Initialize a bunch of variables, mostly with attributes about the browser and page, such as the HTTP referrer and the current URL, date, browser resolution, etc.

var a1156tf = "51la";
var a1156pu = "";
var a1156pf = "51la";
var a1156su = window.location;
var a1156sf = document.referrer;
var a1156of = "";
var a1156op = "";
var a1156ops = 1;
var a1156ot = 1;
var a1156d = new Date();
var a1156color = "";
if (navigator.appName == "Netscape") {
    a1156color = screen.pixelDepth;
} else {
    a1156color = screen.colorDepth;
}
try {
    a1156tf = top.document.referrer;
} catch (e) {}
try {
    a1156pu = window.parent.location;
} catch (e) {}
try {
    a1156pf = window.parent.document.referrer;
} catch (e) {}
try {

Appears to be looking for any existing cookies set by this application in order to keep a count of how many pages have been visited. This value is incremented and stored in a cookie.

    a1156ops = document.cookie.match(new RegExp("(^| )a1156_pages=([^;]*)(;|$)"));
    a1156ops = (a1156ops == null) ? 1 : (parseInt(unescape((a1156ops)[2])) + 1);
    var a1156oe = new Date();
    a1156oe.setTime(a1156oe.getTime() + 60 * 60 * 1000);
    document.cookie = "a1156_pages=" + a1156ops + ";path=/;expires=" + a1156oe.toGMTString();

It basically seems to be trying to record how many distinct pages you've viewed. Again it uses a cookie to help remember if you've already visited.

    a1156ot = document.cookie.match(new RegExp("(^| )a1156_times=([^;]*)(;|$)"));
    if (a1156ot == null) {
        a1156ot = 1;
    } else {
        a1156ot = parseInt(unescape((a1156ot)[2]));
        a1156ot = (a1156ops == 1) ? (a1156ot + 1) : (a1156ot);
    }
    a1156oe.setTime(a1156oe.getTime() + 365 * 24 * 60 * 60 * 1000);
    document.cookie = "a1156_times=" + a1156ot + ";path=/;expires=" + a1156oe.toGMTString();

Miscellaneous stuff, probably just to cater to differing browser capabilities and settings, such as cookies being disabled.

} catch (e) {}
try {
    if (document.cookie == "") {
        a1156ops = -1;
        a1156ot = -1;
    }
} catch (e) {}
a1156of = a1156sf;
if (a1156pf !== "51la") {
    a1156of = a1156pf;
}
if (a1156tf !== "51la") {
    a1156of = a1156tf;
}
a1156op = a1156pu;
try {
    lainframe
} catch (e) {
    a1156op = a1156su;
}

Write all this information as GET parameters in the source attribute of an image. Your browser will load this then their server can record the data.

a1156src = 'http://web.51.la:82/go.asp?svid=8&id=17211156&tpages=' + a1156ops + '&ttimes=' + a1156ot + '&tzone=' + (0 - a1156d.getTimezoneOffset() / 60) + '&tcolor=' + a1156color + '&sSize=' + screen.width + ',' + screen.height + '&referrer=' + escape(a1156of) + '&vpage=' + escape(a1156op) + '&vvtime=' + a1156d.getTime();
setTimeout('a1156img = new Image;a1156img.src=a1156src;', 0);

Basically it's tracking you, including the page you're viewing, how many times you've viewed the site, how many pages you've viewed, what your browser resolution is, etc.

This could be malicious depending on the circumstances, although most websites run tracking of some form such as Google Analytics. It doesn't pose a threat to the integrity of your machine as someone viewing the site, but it might be a threat to your privacy.

The odd variable names do make it seem like obfuscated malware, but I suspect this is to avoid variable naming conflicts with other JavaScript.

Answer 2

No, it doesn't look like a virus, but definitely like an attempt to track your visits across different sites.

Basically, it collects a bunch of information about your browser, some cookies and which page you've come from, and puts all these as parameters into the URL of an image it loads from a server. That server can then aggregate this information from your visits to this and other sites with the same code into a user profile, which will probably be used to show you targeted advertising.

Answer 3

So this showed up on a site that I had built for somebody. Here is what I can see symptomatically (I am not a programmer).

This software is installed on sites specifically to redirect the google spider bot to pick up a ton of content that is not actually on the targeted site. When in play, you will see the traffic to the website increase significantly, but there are no actual benefits to be seen. What these guys are doing is telling google that there is way more content on a website than actually is. When someone clicks on one of these fake links from a google search, they are redirected to a page that sells goods on legitimate sites.

What is happening is that these guys are affiliates of the sites that are selling the goods and they are getting commissions from each on-line sale.

They are parasites who exploit thousands of other peoples' sites to make money for themselves.

Answer 4

I was faced with the same alerts in our environment, so I was curious what is generating this traffic. When you think about it, there needs to be some malware installed in your browser as a plugin or similar, because I can clearly see Google search results with this URL.

Example:

web.51.la:82/go.asp?svid=8&id=15942596&tpages=1&ttimes=1&tzone=8&tcolor=24&sSize=1440,900&referrer=https://www.google.de/&vpage=http://www.qupingche.com/comment/show/103&vvtime=1409818963602

When you go to the page http://www.qupingche.com/comment/show/103, it's a Chinese website that I'm 100% sure you didn't visit. On its page, you can see the web51.la stuff in this script:

<script language="javascript" type="text/javascript" src="http://js.users.51.la/15942596.js">
</script>

And when you check the variable of the JavaScript, it's incrementing requested location by one every 10 seconds.

This is what I saw:

js.users.51.la/15942596.js

And this is the latest one with the same content:

js.users.51.la/15994950.js

So when you see this request from your client, then there needs to be some malware generating this request on your computer!