Have you ever seen something like this before?

var1=[Integer];
var2=var1;
if(var1==var2) { document.location=”[Insert URL Here]“; }

I have, and today I finally decided to dig a little deeper. In this article we will cover URLs that are used with this redirecting method, other malicious JavaScript files that have adapted to this method, and test this method with various techniques against the AV industry.

Here is the complete list of the URLs I found that are used as the document.location:

hXtp://ukr.net
hXtp://topsearch10.com/search.php?aid=62756&q=home+jobs
hXtp://popka-super.ru
hXtp://realstarsearch.com/search.php?q=runescape+automine
hXtp://zaebiz.info
hXtp://global-advers.com/soft.php?aid=0153&d=2&product=XPA
hXtp://www.mp3sugar.com/?aff=2081
hXtp://evamendesochka.com/go.php?sid=9
hXtp://catalog--sites.info/sea
hXtp://yahhooo.info/search.php?q=ritalin&tpl=forbot
hXtp://tnij.com/iewt
hXtp://clickcashmoney.com/in.htm?wm=101360
hXtp://www.rarewatches.net
hXtp://web4w3.com/jblob.html
hXtp://мой_сайт.ру
hXtp://www.xakep.ru
hXtp://go.1ps.ru/pr/p.php?223280
hXtp://www.searchfor-avail.com/search.php?aff=18424&q=audrey+bitoni
hXtp://www.vipspace.net/?ref=kuzma2002ru
hXtp://officialmedicines.com/item.php?id=162&aid=2268
hXtp://zonaconsult.ru/index.php?option=com_content&view=article&id=94
hXtp://porta100.narod.ru
hXtp://куда редиректить.ru
hXtp://www.0xy.ru
hXtp://имя домена.ru
hXtp://www.autoshkatulka.ru/index.php
hXtp://www.vsemayki.ru/?ref=11049
hXtp://www.ruclicks.com/in/ys0ik6uu
hXtp://www.links-service.info/search.php?q=Abortion+pill
hXtp://tvoi-dosug.com/in.htm?wm=1001116
hXtp://hotkeysearch.com/go.php?sid=2
hXtp://geforceexlusive.ru:8080/forum/links/column.php

I also found something else rather interesting. There is an “o.js” that uses this method in a more advanced way. Have a look at these two Wepawet results here and here. Notice how they use additional variables whilst using the same concept.

So, let’s make our own redirecting JavaScript! The Wepawet examples are from 2009, so this should have good detection, right?  We will conduct various test to ensure that our results are not flawed. Have a quick look at the list:

  1. The Default Approach
  2. Different Variable Names
  3. Additional Variables
  4. Number Obfuscation
  5. String Obfuscation

Before we move on, for those who would like to do this with me, make sure you have your favorite editor open. I myself use Sublime Text. You can download the samples we will be using from my domain here.

 

The Default Approach – VirusTotal (5/46)

Conditional Redirect Test 1

Well now.. I didn’t expect that myself. Maybe 8-14/46 but 5/46? More so they show the same threat name? I’m speechless considering this was the first test..

 

Different Variable Names – VirusTotal (5/46)

Conditional Redirect Test 2

Ok, so everybody can still detect it. That’s a good thing. How about when we add additional variables?

 

Additional Variables – VirusTotal (0/46)

Conditional Redirect Test 3

And just like that, nobody detects. Seriously, WTF? This kind of simple variable trick passes? In my opinion, more should’ve detected it then the first time, considering it explicitly passes “document” into another variable to be called with with window.

 

Number Obfuscation – VirusTotal (0/46)

Conditional Redirect Test 4

None detect this simple obfuscation method? No, just no… The document.location was left in place and obfuscation was added. I expected more to detect this..

 

String Obfuscation – VirusTotal (0/46)

Conditional Redirect Test 5

Err… how does this miss? ._.

 

We can conclude that the AV industry uses a simple method for checking this kind of exploit. It would look something like this:

When a variable (Var A) is defined,
And another variable (Var B) is set to Var A,
With a conditional between each (Var A and Var B),
And an expression utilizing document.location,
That contains a string (not a variable) with a passed URL,
Then alert and mark as malicious.

Follow the discussion on the avast! forums,

~!Donovan

Advertisements