Obfuscated script (likely malware)

Bernhard Hiller

What does following script do:

I found it embedded in a page which looks harmless... [Edit]I guess it is the same type of hack which I experienced 1.5 years agon on my web site, but the hacker added some more obfuscation now. See Analysing an obfuscated malware script[^].[/Edit]

Kornfeld Eliyahu Peter

It's not obfuscated, but minified and it looks like a timing function, based on Google's library...

I'm not questioning your powers of observation; I'm merely remarking upon the paradox of asking a masked man who he is. (V)

Bernhard Hiller

Thanks for your analysis. I hardly ever use JavaScript, so I rely mainly on context and experience. "minify" and "obfuscate" cause the same impression...

DragonHeart335

Don't know a lot about Javascript, but there seem to be multiple syntax errors in your script.

Kornfeld Eliyahu Peter

Where?

I'm not questioning your powers of observation; I'm merely remarking upon the paradox of asking a masked man who he is. (V)

DragonHeart335

(function() -- Isn't the leading ( a syntax error in Javascript? It is found several times in the script above.

Kornfeld Eliyahu Peter

It's perfectly normal - it called closure... https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Closures[^]

I'm not questioning your powers of observation; I'm merely remarking upon the paradox of asking a masked man who he is. (V)

DragonHeart335

Ok, found it. I was looking for the CLOSING parenthesis. When I first loaded it into Notepad++ I didn't see it. Thx for the link.

Nicholas Marty

minifying is just to decrease the size of the script and thus decreasing the time needed for loading it from the server obfuscating the code is done to protect the code to some degree from beeing copied by others. You can't compile javascript into a binary form that prevents doing so (you can't compile any .Net applications in that regard neither) so in those cases obfuscation makes it harder to understand the code. A small sample (consider this as a piece of pseudo code)

function foo() {
// do foo
var counter = 0;
bar(counter);
}
function bar(var myParam) {
// do something with myParam
var somethingElse = myParam;
}

and obfuscate it to

function a() {
var b=0;
a(b);
}
function a(var b) {
var c=b;
}

you don't really know what those function really do without having the full context of it, thus making it a lot harder to just copy a function out of the script "stealing" someone else's hard work. So nothing shady about those (of course you could assume that malicious scripts will usually be obfuscated and minified to prevent user from easily detect what they are doing)

Bernhard Hiller

Thanks for this explanation. It was the context (faked entry in a log file) paired with past experience and the unreadability of that script which made me assume malware. Though minifying scripts may be legitimate to decrease the still increasing enormous volumes of JavaScripts sent over the network with still decreasing "payload" of actual content, it makes distinguishing those scripts from intentiously obfuscated malware scripts extremely hard - thus actually causing security issues.

jkirkerx

Just for the hell of it, I ran it through the beautifier to get a better look at it. http://jsbeautifier.org/[^]

function m() {
    l || (l = !0, b\[g\].load\[k\]("firstScrollTime"))
}
b.addEventListener ? b.addEventListener("scroll", m, !1) : b.attachEvent("onscroll", m);

})();

Bernhard Hiller

Thanks for that link.

User 11056480

malwares suck !! my computer has crashed twice becoz of it !! ask someone like me who knows what de pain is !! CLT20 2014
CLT20 2014 Live
CLT20 2014 live streaming
CLT20 2014 matches
CLT20 2014 Teams
CLT20 2014 Highlights