Schinckel.net

Howard heart-attack email carries virus :: Hack In The Box :: Keeping Knowledge Free What a shame it isn’t true… Anyway, I did some digging, and this is what happens: The site listed pushes you to a couple of other pages, via framesets. Then, there is a clever JavaScript which decrypts another script, this time written in VBScript. This script downloads, and executes, a Windows executable. Which apparently is a nasty piece of work. The clever parts are these: The method of encrypting the JavaScript. It uses a simple replacement method to take a string, which appears meaningless, and return it to a plaintext. Nothing too hard here, except it’s a somewhat complex algorithm to get that far. If you are interested:

    function makemelaugh(x) { 
        var l = x.length, b = 1024, i, j, r, p = 0, s = 0, w = 0, 
            t = Array(63, 16, 44, 51, 25, 37, 46, 62, 8, 18, 0, 0, 0, 0, 0, 0, 45, 28, 13, 4, 
                      30, 31, 48, 12, 21, 60, 47, 29, 2, 17, 23, 15, 40, 11, 1, 9, 34, 0, 26, 49, 
                      43, 58, 53, 0, 0, 0, 0, 56, 0, 10, 3, 42, 5, 59, 41, 22, 19, 27, 61, 33, 7, 
                      54, 55, 20, 50, 6, 57, 39, 36, 14, 52, 32, 24, 38, 35); 
        for (j = Math.ceil(l / b); j > 0; j--) { 
            r = ""; 
            for (i = Math.min(l, b); i > 0; i--, l--) { 
                w |= t[x.charCodeAt(p++) - 48] << s; 
                if (s) { 
                    r += String.fromCharCode(170 ^ w & 255); 
                    w <<= 8; 
                    s -= 2; 
                } else { 
                    s = 6; 
                } 
            } 
        temp = temp + r; 
        } 
    }
    

I’ve made it less dangerous by replacing the document.write(r) with temp = temp + r. This way, I could just get the text, rather than have my browser execute it. This function, makemelaugh(), is run on a block of text, resulting in a script that, as mentioned, downloads, and then executes a file. I think the first half of the script is based on the second half, as the second script block points to a file that doesn’t exist. And the first part is a little cleverer, in that the filename it chooses for the executable is random. Meaning that a virus checker can’t rely on a particular filename when scanning. The file appears to be exactly 2006 bytes in length, but I don’t have the tools on the machine it’s stored on to look further at it. And I don’t want to bring it to the PC I’m at now in case I accidentally execute it! Apparently the virus isn’t anything to do with John Howard, that’s just the delivery vector. Basically, you are safe from this virus if you are using a Mac. You are safe from this virus if you don’t have JavaScript, or VBScript turned on. And, I think you are safe from this virus if you are using Firefox. But I’m not so sure about this. However, if you are using IE, on a Windows machine, don’t go to the address… Nah, I’m not going to link to it…