Hackers have hit on a new technique for invading desktop computers via compromised Web sites, while avoiding anti-virus detectors, according to the SANS Institute.
“What makes this new is that the hosting website generates this code dynamically,” he wrote in an analysis. “Every time you request this web page it will use completely random names for all variables and functions… changing variable and function names even causes the payload information to change.”
The technique makes the script code effectively undetectable by common types of malware scanners, Zdrnja said.
“Such heavy obfuscation makes signature-based detection much more difficult, if not impossible,” he wrote. None of the anti-virus programs Zdrnja tested were able to detect the modified code.
The code contains what Zdrnja called a “typical” set of exploits, making use of known vulnerabilities in ADODB, QuickTime, WinZip, and other software.
The code also included a less well-known, but highly pernicious exploit for the NCTAudioFile2 ActiveX control, Zdrnja said.
“A fully working exploit was publicly released in April, and what’s worse is that the affected ActiveX control is delivered with dozens of popular audio/video applications,” Zdrnja wrote.