JS_OBFUSCAT.SME

October 08, 2012
 Analysis by: Michael Cabel
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan may be downloaded from remote sites.

It posts messages on the affected user's Facebook wall.

These messages contain links that include an instruction about the Facebook credits glitch.

Once the unsuspecting user followed the instruction on these messages, an event is created unknowingly. It then invites user’s friends through wall post tagging.

Users are also redirected to a malicious URL.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

JS

Initial Samples Received Date:

17 Mar 2011

Arrival Details

This Trojan may be downloaded from the following remote sites:

  • http://{BLOCKED}.info/e.js

NOTES:

This JavaScript posts a message on the affected user's Facebook wall:

The following are the sample messages:

{Random Names} did you guys hear about the facebook glitch you can get 500 facebook credits ?check it out

{First Name} just tried this and got 500 facebook credits works great

Hey , I learned a way to get 750 credits hurry before the Trick is fixed. all you have to do is go to this link and follow the directions

Hey , I found a way to get 1000 real credits Just follow the instructions on the website below!

The said messages contains any of the following links that contains an instruction about the Facebook credits glitch:

  • http://{BLOCKED}m.recomnet.info/?a79qr
  • http://{BLOCKED}y.46ssf.info/?90k3l1y
  • http://{BLOCKED}m.recomnet.info/?ra6b4
  • http://{BLOCKED}8.dfgdfg2.info
  • http://{BLOCKED}.info/jx2/f.js
  • http://{BLOCKED}m.alunet.info/?bec40
  • http://{BLOCKED}t.hfgh7.info/f.js
  • http://{BLOCKED}t.hfgh7.info

Once the unsuspecting user followed the instruction on these messages, an event is created unknowingly. It then invites user’s friends through wall post tagging.

The user will also be redirected to the following malicious URL:

  • http://{BLOCKED}t-com.info/final.php

  SOLUTION

Minimum Scan Engine:

8.900

FIRST VSAPI PATTERN FILE:

7.908.09

FIRST VSAPI PATTERN DATE:

17 Mar 2011

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Scan your computer with your Trend Micro product to delete files detected as JS_OBFUSCAT.SME. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.