Author Topic: JS:Bulered  (Read 23678 times)

0 Members and 1 Guest are viewing this topic.

Filter

  • Guest
Re: JS:Bulered
« Reply #15 on: July 20, 2009, 01:38:34 PM »
Sophos detects it as suspicious behaviour but not so much as an infection, probably because of the wrong placement.
The code is in the wrong place, but that only seems to be because he doesn't have enough knowledge on where to put it.
Still feel that on itself shouldn't be enough to set off avast for a trojan though? Ahh well.

Offline jsejtko

  • Avast team
  • Full Member
  • *
  • Posts: 171
    • ALWIL Software
Re: JS:Bulered
« Reply #16 on: July 20, 2009, 02:23:40 PM »
Apparently, he put that code there himself :-\
He says in that code is all the information that goes into the ticker signatures.

But just the strange placement of that code shouldn't set off avast though? Or does it and is it a false positive?

This is not a false positive!! I'm pretty sure hes not the creator of this script - it is infection. After unpacking that huge script (3 layers) you will see an iframe creation with malicious target url.

If he says that the code contains some info, then I ask what info? There is just one malicious iframe.

Regards

spg SCOTT

  • Guest
Re: JS:Bulered
« Reply #17 on: July 20, 2009, 03:23:51 PM »
Apparently, he put that code there himself :-\
He says in that code is all the information that goes into the ticker signatures.

BS

I'm sorry but there is NO reason to put ANY code outside of the html tags, and obfuscate it too
That spells disaster, even before it is actually malicious, which incidently it is.

Is he looking at the source code at all, let alone the right part ???

Quote
But just the strange placement of that code shouldn't set off avast though? Or does it and is it a false positive?
Correct me if I'm wrong but avast is not alerting to the strange placement, it is alerting to the actual content, which jsetko has explained.

-Scott-

Offline .: L' arc :.

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1780
  • Thinking with Portals
Re: JS:Bulered
« Reply #18 on: July 20, 2009, 03:36:17 PM »
 No reasons to bash but, I believe, it is on the website author's side where the move must be done [modify the source code] rather than avast set it as a false positive.

 avast has no fault of the script being placed outside the <html></html> tag.
Windows 7 (64-bit) Home Premium SP1
avast! 9 RC1

Filter

  • Guest
Re: JS:Bulered
« Reply #19 on: July 20, 2009, 03:54:56 PM »
The way he handled it yesterday didn't make sense to me in the first place. He just brushed it off, seemed like he had no idea what I was talking about. I agree it's his move though, but I'm not giving up this easily :P Other cases on this forum concerning JS:Bulered were exactly the same as this one. Thanks again guys for the help, I appreciate it  :) I've passed the info on that you provided jsetsko, thanks. I think he's probably talking about another script or something.
« Last Edit: July 20, 2009, 04:18:14 PM by Filter »

spg SCOTT

  • Guest
Re: JS:Bulered
« Reply #20 on: July 20, 2009, 03:58:40 PM »
The way he handled it yesterday didn't make sense to me in the first place. He just brushed it off, seemed like he had no idea what I was talking about.
Yes, this is a common reaction to this - the 'I know better than you because I run a website' attitude


Filter

  • Guest
Re: JS:Bulered
« Reply #21 on: July 20, 2009, 04:34:03 PM »
Or maybe he really has no clue. Anyway, another forum member with avast has the same issue and posted a link to this thread, so maybe he'll get any wiser from this discussion here.

spg SCOTT

  • Guest
Re: JS:Bulered
« Reply #22 on: July 20, 2009, 04:39:08 PM »
...so maybe he'll get any wiser from this discussion here.

We can only hope...;)

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89205
  • No support PMs thanks
Re: JS:Bulered
« Reply #23 on: July 20, 2009, 05:19:56 PM »
Apparently, he put that code there himself :-\
He says in that code is all the information that goes into the ticker signatures.

But just the strange placement of that code shouldn't set off avast though? Or does it and is it a false positive?

I have to wonder why they are obfuscating javascript (what do they have to hide), which is essentially a plain language scripting tool and then stick it outside the html tags just adds to that suspicion.

@ .: L' arc :.
One of the problems in this is when sending it to VT, there are very few of those scanners that are even looking for this type of thing.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: JS:Bulered
« Reply #24 on: July 20, 2009, 08:30:36 PM »
One of the problems in this is when sending it to VT, there are very few of those scanners that are even looking for this type of thing.
Fully agree with David. The reality is that avast is behind any other competitor in this meaning.
The best things in life are free.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33925
  • malware fighter
Re: JS:Bulered
« Reply #25 on: July 20, 2009, 08:51:52 PM »
Hi Tech, DavidR and Filter,

I had WEPAWET analyze the site: wXw.forumticker.nl
Results: http://wepawet.iseclab.org/view.php?hash=81df9d5d82e0346347bd3bdb4eed0ebd&t=1248116104&type=js

pol
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: JS:Bulered
« Reply #26 on: July 20, 2009, 09:00:30 PM »
I had WEPAWET analyze the site
Thanks Polonus, but it's too technical for me... I wish a clear information: infected or not. I think average user will think the same.
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89205
  • No support PMs thanks
Re: JS:Bulered
« Reply #27 on: July 20, 2009, 09:01:40 PM »
One of the problems in this is when sending it to VT, there are very few of those scanners that are even looking for this type of thing.
Fully agree with David. The reality is that avast is behind any other competitor in this meaning.

Don't you mean avast is 'ahead' of other competitors as they aren't even checking.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33925
  • malware fighter
Re: JS:Bulered
« Reply #28 on: July 20, 2009, 09:28:23 PM »
Hi DavidR and Tech,

Well you can read it yourself as the analysis says "suspicious" and sites with suspicious code should be blocked, if they actually redirected to a silent malware download host or not, the websites in question should be cleansed from this "Unfug" to use an appropriate German word. That is my two cents on the matter of suspicious code found in webpages....
In most cases the code is malcode or could be abused and this can be established from analyzing at www.unmaskparasites.com via their security report or the malicious iFrames checked against the Bad Stuff Detektor or the site checked against Wepawet-alpha url scanner or blacklistdoctor.com
Use a bookmarklet like this one to show hidden js on a page:
Code: [Select]
javascript:(function(){var%20i,f,j,e,div,label,ne;%20for(i=0;f=document.forms[i];++i)for(j=0;e=f[j];++j)if(e.type=="hidden"){%20D=document;%20function%20C(t){return%20D.createElement(t);}%20function%20A(a,b){a.appendChild(b);}%20div=C("div");%20label=C("label");%20A(div,%20label);%20A(label,%20D.createTextNode(e.name%20+%20":%20"));%20e.parentNode.insertBefore(div,%20e);%20e.parentNode.removeChild(e);%20ne=C("input");/*for%20ie*/%20ne.type="text";%20ne.value=e.value;%20A(label,%20ne);%20label.style.MozOpacity=".6";%20--j;/*for%20moz*/}})() "Good for you analyzers to keep an eye on the sparrow!"
Yes good forum friends, we are in the top league in this respect, avast is leader here, so polonus is also out in the trenches and I put all we have found over recent months in long threads at InformAction Forums where each an every malcode script is discussed in length with the protection of NoScript in mind, re: http://forums.informaction.com/viewtopic.php?f=8&t=1028
(my nick is luntrus there). Keep on the look-out, folks, and keep your shields up, avast knights,

polonus
« Last Edit: July 20, 2009, 09:30:30 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Filter

  • Guest
Re: JS:Bulered
« Reply #29 on: July 20, 2009, 09:32:36 PM »
Hi Tech, DavidR and Filter,

I had WEPAWET analyze the site: wXw.forumticker.nl
Results: http://wepawet.iseclab.org/view.php?hash=81df9d5d82e0346347bd3bdb4eed0ebd&t=1248116104&type=js

pol
Could you or anyone else maybe explain that report?
The only things I can find that seem off is the url redirects at the bottom: hXtp://exist.butterflyeffect.gs/Trop and hXtp://ipot.applepie.gd/privatezone/?d6fb367bf8c5480228703541f761eb18
Both those sites are blocked by Google and thus can be seen as malicious?