“ILOVEYOU” again! Or not?
The beginnig and the end of the script is shown in the next image where important parts are underlined (red color). This is really unusual obfuscation – string “ILOVEYOU” is used to rebuild string “eval” using sequence substring -> split -> reverse -> join -> toLowerCase -> replace. Bizarre, isn’t it? But it is not the last odd thing about this script. Original script is hidden under long string, that consists of limited number of characters which are decrypted using last sequence of function calls (shown at the last line in the next image).
Who would use something like this for legal purposes? This can’t be made by any big company, isn’t it? But! We had to remove our detection this morning, because this script belongs to local Czech newspaper portal – it is part of their new ad system. And I’m still waiting for their response to my questions:
What is the conclusion here? Well, web designers should be more careful about what they publish. It is not very smart idea to use or create obfuscation/encryption on your own website, especially when the internet is full of legitimate websites that are getting infected with enormous speed. Why? Because antivirus scanners are getting very sensitive about suspicious operations -> we must protect our users!
Avast Threat Intelligence has identified a new advanced persistent threats (APT) campaign targeting government agencies and a government data center in Mongolia.
Our Aposemat Team has been testing the capabilities of IPv6 and how malware could take advantage of it. One of the topics explored was exfiltration of data via the IPv6 protocol, which we discuss in this post.
Popular banking services, including PayPal, Revolut and Venmo, allow users to request money from others with a few easy steps. Although simple, this functionality could increase the likelihood of related spearphishing attacks.