Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

Lessons in Spam JavaScript Obfuscation Layers

Spammers seem to be adding layers of obfuscation to their malware attachments in an attempt to evade spam filters that look inside attachments. Most malware attachments come in the form of executables, or, increasingly, Word files with malware-laden macros. These files are usually zipped, a common method of passing files via email. Most email gateways can unzip attachments to inspect the underlying file, so this simple layer of masking the file's true nature is becoming increasingly useless.

We've seen some recent examples of malware attachments that are adding an extra layer of obfuscation to make inspecting attachments more difficult. We've seen attachments that are double-zipped (whereby the executable is zipped and that resulting zip file is zipped again). We've also seen a Word document with macro-malware embedded inside a PDF file. This blog post discusses another type of double-obfuscation we observed in a JavaScript attachment.

The example we'll take a look at purports to attach a copy of a requested passport. The email body looks like:

9292_52893866-ec4f-4eb5-b37b-eb9aed1fb7e7

Having a zipped attachment doesn't raise too many red flags by itself. When this attachment is unzipped, it reveals an obfuscated JavaScript file. This is not unusual in spam. Most zipped JavaScript malware attachments create something like an ActiveXObject which does an HTTP "GET" to download malware from a specified site. Since JavaScript is plain text, it's not too hard for spam filters to unzip the attachment and look for certain strings in the JavaScript file like "ActiveXObject" or "Wscript.Shell", which would indicate intent to download files. In this "passport" example, once this first layer is de-obfuscated, it doesn't contain any of these tell-tale strings. It looks fairly innocuous, like this:

8601_3145e062-d5d3-4e4b-bbc0-345ad7997277

While it does create an ActiveXObject, it only creates a "Scripting.Dictionary" one, which is fairly benign -- not much here would be suspicious to spam filters. The tricky part comes in the random-looking text assigned to the four variables at the top (the highlighted lines). When the JavaScript attachment is run, it creates another JavaScript file that does actually retrieve malware. This first JavaScript file merges the four variables, going through the resulting string and only printing every other letter to the new JavaScript file. For instance, the string "fnugnicptlioosnr" becomes "function" and "ooypfehns(s"qGdEzTk"t," becomes "open("GET",". This method allows for the replacement of the skipped letters with different ones for each spam run, preventing spam filters from looking for the obfuscated string. The last few lines use programming tricks to obfuscate the fact that the final line is really an eval call with the second script in a single variable. This runs the second script, which when properly formatted looks like this:

9249_50091541-2fa6-4d95-8e35-e7cc8cb53968

This looks much more like a typical script that results in the download of malware. The script visits the web sites listed at the bottom, retrieves what would seem to be pictures (judging from the URLs) but are in reality executables (as evidenced by the script saving the files as .exe files in the TEMP directory). The downloaded files are then executed by the "Run" statement. The malware files it downloads are in the MSIL Trojan Injector family.

This type of multi-layered obfuscation is often used by exploit kits. When an unsafe link is clicked, the kit uses this sort of trick to provide the landing page code that's rendered in the browser in an attempt to evade AV scanners and web gateways looking for suspicious traffic. As spammers try to transfer these tactics to email attachments, safe email practices become increasingly necessary. As always, DO NOT open attachments from senders you don't recognize, and be suspicious of any attachment you weren't expecting. If needed, verify with the sender before opening.

Latest SpiderLabs Blogs

Trustwave SpiderLabs: Insights and Solutions to Defend Educational Institutions Against Cyber Threats

Security teams responsible for defending educational institutions at higher education and primary school levels often find themselves facing harsh lessons from threat actors who exploit the numerous...

Read More

Breakdown of Tycoon Phishing-as-a-Service System

Just weeks after Trustwave SpiderLabs reported on the Greatness phishing-as-a-service (PaaS) framework, SpiderLabs’ Email Security team is tracking another PaaS called Tycoon Group.

Read More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising

During an Advanced Continual Threat Hunt (ACTH) investigation that took place in early December 2023, Trustwave SpiderLabs discovered Ov3r_Stealer, an infostealer distributed using Facebook...

Read More