B.I.S.S. Forums > Blogspot spam using javascript for redirection

Full Version: Blogspot spam using javascript for redirection

B.I.S.S. Forums > Malware Research Forum > Malware IP Research Section

jfrankparnell

Mar 19 2009, 04:53 PM

hi -

I found your forum doing a little 'research' on a Blogspot spam I received.

CODE

You Have Been Selected to Try Acai Burn For *Free* http://computronmeritoriousnessnj.blogspot.com/?id=73fhkr3q

The blog fits the pattern of redirection we've seen in blogspot spam - and if you were to load this into IE, you get redirected to a My Pure Acai spam page.

What's interesting - if you load in Firefox with NoScript, nothing happens UNTIL you start enabling Javascript. And in fact, you'll notice that one of the domains to be enabled is myadslink.com

In fact, this bit of code in the Blogspot HTML got my eye:

CODE

http://myadslink.com/adsense/show_ads.js

I found this topic here:
Info on myadslink.com and Malware

So I looked at the javascript. I couldn't find the website the blogspot redirects to.

I'm blocked from myadslink.com right now, but I think this snippet of javascript is the right source.

Do you have tools for parsing javascript? I'm curious if spammy has a list of spamvertized sites on myadslink, or if he's somehow hiding the info on the Blog.

Here's the code - and thanks in advance:

CODE

jfrankparnell

Mar 19 2009, 09:05 PM

An update:
If you remove the ID from the spamvertized URL, the Javascript will not load myacaiburn6.com.

For the spam I received:
ID=73fhkr3q
URL=myacaiburn6.com

A quick reverse IP shows:
Domaintools reverse IP
that spammy created 24 sites - of the form myacaiburn#.com (from 1 to 23, along with my acaiburn.com)

Somehow the ID is encoded back to a website name. I noticed a random number generator in the code, so it's possible that the ID is converted to "acaiburn"; the prefix "my" could be appended, and the random # generator could be used to generate 1-24 at random

Note: I formatted the javascript to make it readible - shall I re-post this?

Kimberly

Mar 19 2009, 09:27 PM

Hi jfrankparnell,

myadslink.com/adsense/show_ads.js is indeed the page refering to the ad. The snipit you did post is related to google, not the show_ads.js

CODE

HTTP/1.1 200 OK
Date: Thu, 19 Mar 2009 13:15:09 GMT
Server: Apache
~~~~~~~~~~~~~~: ~~~~
Connection: close
Content-Type: text/html; charset=so-8859-1
Content-Length: 1146

function queryString(parameter) {
  var loc = location.search.substring(1, location.search.length);
  var param_value = false;

  var params = loc.split("&");
  for (i=0; i<params.length;i++) {
      param_name = params[i].substring(0,params[i].indexOf('='));
      if (param_name == parameter) {
          param_value = params[i].substring(params[i].indexOf('=')+1)
      }
  }
  if (param_value) {
      return param_value;
  }
  else {
      return false;
  }
}

//alert('http://myacaiburn6.com/');
//alert('JS CALLED');

    var url = 'http://myacaiburn6.com/';
    var aid = queryString("a_aid");
    var bid = queryString("a_bid");

    if (aid == false) {
        var loc = url;
    }else if (bid == false) {
        var loc = url;
    }else{
        var loc = url + '?a_aid=' + aid + '&a_bid=' + bid;
    }

//alert(loc);

//document.write("<br> READ MORE... <br><form name=subm id=subm action='"+loc+"' target=_top method=POST>");
document.write("<br><br><form name=subm id=subm action='"+loc+"' target=_top method=POST>");
document.write("</form>");

subid=document.getElementById('subm');
subid.submit();

window.status="Done";

myacaiburn6.com is the "My Pure Acai spam"

myacaiburn6.com IP:

24.193.69.243
71.140.203.75
75.4.218.155
82.143.216.178
83.217.2.171
85.54.241.186
99.33.113.205
99.228.191.157
137.49.17.86
190.46.85.81

Registrar: XIN NET TECHNOLOGY CORPORATION
Name Server: NS1.AMDNAMESERVER.COM
Name Server: NS2.AMDNAMESERVER.COM
Name Server: NS3.HARDNAMESERVER.COM
Name Server: NS4.AMDNAMESERVER.COM
Name Server: NS5.HARDNAMESERVER.COM
Name Server: NS6.HARDNAMESERVER.COM
Updated Date: 17-mar-2009
Creation Date: 05-mar-2009

QUOTE

Do you have tools for parsing javascript?

I use wireshark or FiddlerCap to capture the network traffic, Malzilla to decode / deobfuscate JavaScript.

jfrankparnell

Mar 19 2009, 10:10 PM

QUOTE (Kimberly @ Mar 19 2009, 05:27 PM)

Hi jfrankparnell,

myadslink.com/adsense/show_ads.js is indeed the page refering to the ad. The snipit you did post is related to google, not the show_ads.js

I use wireshark or FiddlerCap to capture the network traffic, Malzilla to decode / deobfuscate JavaScript.

Thanks a lot, Kimberly - I have the feeling we haven't seen the last of these, so those tool recommendations will be handy.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.