The recent Ecard.exe trojan is spread via web pages served by infected machines. When a user receives an Ecard email (typical subject line: “Thank you e-card”) and clicks on the link in it, he ends up at a page that has an <embed> tag that will be displayed with a Windows Media Player object on Windows.
There is also a link to manually download the trojan file. This analysis will focus on the page contents, with a full analysis of the obfuscated and encrypted JavaScript that triggers the exploit.
If you view the source of an Ecard web page, you will see a piece of JavaScript that starts with the following:
function xor_str(plain_str, xor_key){ var xored_str = "";for (var i = 0 ; i < plain_str.length; ++i)
xored_str += String.fromCharCode(xor_key ^ plain_str.charCodeAt(i)); return xored_str; }
var plain_str = "xb1x9cx9bx9cx9bx9c (...)
What this script does is take the variable named plain_str and decrypts it using simple XOR decryption (with the key 145 in this case). The result is another piece of JavaScript that starts off with 78 line breaks (presumably to make it harder to display the decrypted code using a JS alert() dialog). Following the line breaks you find the new JavaScript code:
var s=unescape("...");do{s+=s;}while(s.length<0x0900000);
s+=unescape([long unicode string])
(...)
<EMBED src="------------ (...)
This code snippet writes out HTML that triggers the Windows Media Player Plug-In EMBED Overflow Exploit (MS06-006). The JavaScript uses a for-loop to create a huge string that holds the buffer overflow data. Once the exploit is successfully triggered, the ecard.exe file is downloaded and installed. It will then in turn start up a web server on the infected machine, and start sending out emails to new unsuspecting victims, making the cycle complete.
Since this worm exploits a flaw in Windows, it can affect you whether you use Internet Explorer or Firefox to browse the web. The only way to be safe against this exploit is to have the Security Update for Windows Media Player Plug-in (KB911564) installed. Check your Windows folder for the presence of the file KB911564.log - if it exists you are patched and secured against this exploit.
