Tag Archive: redirect


A few days ago, Polonus posted about the relationships between unknown html and xmlrpc.php malware. Recently, Essexboy, Polonus, and I had the opportunity to help out a website owner that was infected by his own site. Check out the avast! topic.

At first, the website appeared ok. However, with a search referral, I was shown a 302 (redirect) in the header.

HTTP/1.1 302 Moved Temporarily
Date: Thu, 28 Feb 2013 19:29:17 GMT
Server: Apache
Location: hXtp://fpert.qpoe.com/
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 20
Connection: close
Content-Type: text/html

Also see: urlQuery Report & Sucuri Results

So then, I wondered, what was the root cause behind the redirect? At first, I thought it was an .htaccess redirect, but later, Polonus discovered that it was an xmlrpc.php redirect.

Always keep your WordPress up-to-date,
~!Donovan

Advertisements

I was looking at some images on Google and was looking at this particular site when I noticed that there was a unusual url request. I did some investigations and found out that the URL request was a malicious hXXp://hzebw.portrelay.com/jentrate.php

Please note that when I tried using automated analysis on the site, using the same referrers and different scanners, the return didn’t include a jentrate.php. You may also want to see the urlQuery results. Maybe there is a time limit between intervals? Or maybe it’s because I’m using a newer version of Firefox?

Basically, like any exploit, cursor starts flashing and a PDF file is automatically downloaded without user verification. You can only guess what happens next: The downloaded file is immediately ran. I didn’t want to fiddle with the outcome of running this PDF and terminated it upon execution, but if you want to check it out, the VirusTotal results and the download link are below.

Download the PDF (Password: infected): http://db.tt/GAcOjZhx
VirusTotal (6/45) as of 2013-01-24 01:32:17 UTC

Moving along, let’s look for more information about the jentrate.php. A search on Google reveals that this jentrate.php can be traced back to January 15th and 16th of 2013, so this is very new. Jsunpack results show us a somewhat familiar buffer overflow script. We also have analysis on Minotaur and a similar threat on urlQuery. Interesting, no?

Finally, I sent the malicious URL I encountered to urlQuery and was greeted with what I expected. A search on CleanMX reveals many entries for this site. Apparently the domain is also associated with a “jokevity.jar”. Have a look at the Wepawet scan.

For those who wish to dig deeper into subject, I strongly encourage you,
~!Donovan

Have you ever seen something like this before?

var1=[Integer];
var2=var1;
if(var1==var2) { document.location=”[Insert URL Here]“; }

I have, and today I finally decided to dig a little deeper. In this article we will cover URLs that are used with this redirecting method, other malicious JavaScript files that have adapted to this method, and test this method with various techniques against the AV industry.

Here is the complete list of the URLs I found that are used as the document.location:

hXtp://ukr.net
hXtp://topsearch10.com/search.php?aid=62756&q=home+jobs
hXtp://popka-super.ru
hXtp://realstarsearch.com/search.php?q=runescape+automine
hXtp://zaebiz.info
hXtp://global-advers.com/soft.php?aid=0153&d=2&product=XPA
hXtp://www.mp3sugar.com/?aff=2081
hXtp://evamendesochka.com/go.php?sid=9
hXtp://catalog--sites.info/sea
hXtp://yahhooo.info/search.php?q=ritalin&tpl=forbot
hXtp://tnij.com/iewt
hXtp://clickcashmoney.com/in.htm?wm=101360
hXtp://www.rarewatches.net
hXtp://web4w3.com/jblob.html
hXtp://мой_сайт.ру
hXtp://www.xakep.ru
hXtp://go.1ps.ru/pr/p.php?223280
hXtp://www.searchfor-avail.com/search.php?aff=18424&q=audrey+bitoni
hXtp://www.vipspace.net/?ref=kuzma2002ru
hXtp://officialmedicines.com/item.php?id=162&aid=2268
hXtp://zonaconsult.ru/index.php?option=com_content&view=article&id=94
hXtp://porta100.narod.ru
hXtp://куда редиректить.ru
hXtp://www.0xy.ru
hXtp://имя домена.ru
hXtp://www.autoshkatulka.ru/index.php
hXtp://www.vsemayki.ru/?ref=11049
hXtp://www.ruclicks.com/in/ys0ik6uu
hXtp://www.links-service.info/search.php?q=Abortion+pill
hXtp://tvoi-dosug.com/in.htm?wm=1001116
hXtp://hotkeysearch.com/go.php?sid=2
hXtp://geforceexlusive.ru:8080/forum/links/column.php

I also found something else rather interesting. There is an “o.js” that uses this method in a more advanced way. Have a look at these two Wepawet results here and here. Notice how they use additional variables whilst using the same concept.

So, let’s make our own redirecting JavaScript! The Wepawet examples are from 2009, so this should have good detection, right?  We will conduct various test to ensure that our results are not flawed. Have a quick look at the list:

  1. The Default Approach
  2. Different Variable Names
  3. Additional Variables
  4. Number Obfuscation
  5. String Obfuscation

Before we move on, for those who would like to do this with me, make sure you have your favorite editor open. I myself use Sublime Text. You can download the samples we will be using from my domain here.

 

The Default Approach – VirusTotal (5/46)

Conditional Redirect Test 1

Well now.. I didn’t expect that myself. Maybe 8-14/46 but 5/46? More so they show the same threat name? I’m speechless considering this was the first test..

 

Different Variable Names – VirusTotal (5/46)

Conditional Redirect Test 2

Ok, so everybody can still detect it. That’s a good thing. How about when we add additional variables?

 

Additional Variables – VirusTotal (0/46)

Conditional Redirect Test 3

And just like that, nobody detects. Seriously, WTF? This kind of simple variable trick passes? In my opinion, more should’ve detected it then the first time, considering it explicitly passes “document” into another variable to be called with with window.

 

Number Obfuscation – VirusTotal (0/46)

Conditional Redirect Test 4

None detect this simple obfuscation method? No, just no… The document.location was left in place and obfuscation was added. I expected more to detect this..

 

String Obfuscation – VirusTotal (0/46)

Conditional Redirect Test 5

Err… how does this miss? ._.

 

We can conclude that the AV industry uses a simple method for checking this kind of exploit. It would look something like this:

When a variable (Var A) is defined,
And another variable (Var B) is set to Var A,
With a conditional between each (Var A and Var B),
And an expression utilizing document.location,
That contains a string (not a variable) with a passed URL,
Then alert and mark as malicious.

Follow the discussion on the avast! forums,

~!Donovan

Yesterday, Polonus addressed the issue on the avast! forums. Let’s check out the inform.htm.

First, review the VirusTotal results.

The malicious code is as follows:

inform.htm

As you can see, no obfuscation. They aren’t trying to hide anything. Maybe they are trying to reduce general AV detection. And the script looks simple enough, with a redirect to this podarunoki(dot)ru site…

Now we will look two at two urlQuery references: here and here.

Both of these sites, including the one given in the picture above, lead to .ru domains with :8080.

You can check for new malicious inform.htm sites on CleanMX,
~!Donovan

Updated 51la Malware ~ No Antivirus Detects

Reported on the avast! forums, a site recently got hacked and was redirecting users. Based on the Sucuri and VirusTotal results Pondus gave, I decided to dig a little deeper. I found the following in the HTML return for the hacked site:

Which can be beautified as follows:

Well look at that! Some HTML if the user has scripts disabled. And look at that! An .asp file for an image tag. Suspicious, no?

There is also a script tag for those who do run scripts. I sent the URL to JSunpack.

The unreadable code strikes again.. I have parsed it into readable content:

The following checks for specifics, then generates a cookie based on the returns. Shortly after, the document is fed an invisible image with a go.asp?… At least one antivirus should’ve considered this suspicious..

Ok, but does it work? I sent the URL to urlQuery to confirm just that. Notice on the image preview it says “Connecting to web1.51.la”, which means that the exploit is live and active.

Below are the VirusTotal results, not detected by any antivirus..

Script Getter (As seen in Figure 2) | Script Original (As seen in Figure 3) | Script Beautified (As seen in Figure 4)

 

Could use the following syntax: Base([a/random-letter][4-random-numbers])Mix([2-random-letters])

~!Donovan