HTML Lego: Hidden Phishing at Free JavaScript Site

Figure 5. JS Script containing Base64 texts unveils Part 3 and Part 4 of the HTML code

By now we had decoded a bunch of encoded texts which are now mostly readable. In a nutshell, to better understand how it all happened in the background, check the table representation below.

Figure 6. The HTML Lego, stack ‘em up, you’ll see the big picture: Phishing Page

We copied over 367 lines of decoded HTML code in order, combined all five parts into a text file editor, and saved the file as test.htm. Remember the last part of the HTML code at the bottom of the original email attachment we mentioned a while ago? We added that as the last part of the HTM file.

In that final part of the code, we inserted a dummy Base64 Encoded email address (“mydummyemailaddress@nonexistent.com”) to replace one line where the original recipient’s Base64 encoded email address had been.

Figure 7. Setting out the bait email address

We then opened test.htm in a web browser. It pops up a message box notification suggesting the user has been logged out of their account and needs to log in once more. This phishing campaign is aimed at Microsoft Office365 users as the web UI is designed to mimic a login interface of Microsoft, complete with logo. There is also a blurred image of an invoice of some company in the background so that in order to see it properly, victims are lured to key in their password.

Figure 8. This phishing page is targeting Office 365 users.

The email address is automatically populated since we manipulated one into the code. But we also opted to key in an invalid email address. The phishing page has a Regular Expression validator for email addresses. Password keys are hidden masked characters. We keyed in a dummy password – “mydummypassword” in the password field. There is also a validator in this field for a blank password.

Figure 9. Phishing page validates email address format and password length.

After hitting the "Next" button on the phishing page, we were able to capture the HTTP POST request to the form URL. It sends the stolen information: email address, on the user field and password on the pass field. As of this writing, the said URL is still online, probably harvesting credentials from its victims. The form URL has a 302 HTTP response which means redirection to another webpage location. The redirection page is now blocked as a phishing website.

Figure 10. Captured HTTP POST Request and Webpage Redirection

To wrap up, this phishing campaign design was a little more tricky than usual. By improvising an HTML email attachment that incorporates remote JavaScript code located on a free JavaScript hosting site, and ensuring the code is encoded uniquely, the attackers seek to fly under the radar to avoid detection.

IOCs

Files:

FileName:           hercus-Investment 547183-xlsx.H t m l
MD5:                     fd0338283eebe564e6d6dd4f62f5121b
SHA1:                    1d973f88469871cb643c8788945ad9425291d8b0

FileName:           343454545.js
MD5:                     96f8266ae8c07105e6ab3de10b74a959
SHA1:                    9b121f2ec8f7773ef91691db85ab28618d8c73b7

FileName:           8898989-8787.js
MD5:                     ee14a634b41cd67a924eb31c1098a75b
SHA1:                    466424e133d9f86355d8330da6e55a48d6e77d2d

URLs:

• hxxp://yourjavascript[.]com/1129720361/343454545[.]js
• hxxp://yourjavascript[.]com/4231652881/8898989-8787[.]js
• hxxp://tokai-lm[.]jp//shop_pic/656687-98989/43390[.]php?089766543-86564
• hxxp://madassociates[.]asia/css/wrng[.]html