Is this a javascript virus?

Factual Questions
1

I got an email with an attachment. The attached file had an HTML extension. I opened it with notepad and this is the entire contents:

I’m pretty sure it’s nothing good but I’d like to know more. What does this script do?

2

What I can tell you is that it’s taking each of the first 88 items from the two arrays and running an XOR on them. Modding ablest by Satan is irrelevant since ablest will always be < Satan; the expression is the same as just plain ablest.

Now, it’s been a while since I did this by hand, but I’m pretty sure the first one is:
160 ^ 156 = 10100000 ^ 10011100 = 00111100 = 60. The character code 60 gives us a less-than symbol, which is how you start an HTML tag. That tells me it’s probably going to try executing code.
Second: 205 ^ 165 = 11001101 ^ 10100101 = 01101000 = 104; char(104) = “h”.

Hm. That makes it look like it’s creating a header, not a script. Maybe it’s just going to write up a page with a short message and the author wanted to hide the source from you. It’s probably still a good idea to not let it run, though, until you figure out what all the characters are. I could figure it out for you, but I have actual work to do :slight_smile:

3

Well, I was wrong again. Here’s what I got when I dumped the results into a textarea:


<html><body color="red"><a href="http://www.microsoft.com/">Click here</a></body></html>

Why someone would go through all that trouble to obfuscate a link to Microsoft is beyond me. Was there anything to the attachment body other than that script?

Sad thing is, since the link is a link, it won’t even get the red text coloring the author apparently wanted.

4

hehe, you beat me by a few minutes. I took the trouble of doing the XOR with Excel in a roundabout way as I did not find the XOR function there and arrived at the same result as you did except that I noticed the two arrays are of different length. The first one is 88 and XORed with the second yields what you said but the length of the second one is 151 so I am wondering what the second part will yield. I tried XOR with the first part again and several other combinations (000, 255, etc) but nothing meaningful comes out.

The text I posted was the entire attachment. There was nothing more. What would it do with the second part of the second array? XOR it with something?

5

Nope, it won’t do anything. This part:


plummet = 88;
for(ablest = 0; ablest < plummet; ablest++)

means that only the first 88 terms (indexes 0-87) will be used. The other terms in blue won’t get used at all.