I’ve been examining an interesting digital skimmer/magecart script the past couple of days and figured I’d share some details. Perhaps the most puzzling aspect is the three Korean IPs hardcoded into it, although there are a number of other interesting … Continue reading
Malicious code will use a variety of methods to hamper attempts at reverse engineering them. Obfuscation is common, but other methods include purposefully crashing the application that you’re using to inspect the code. One of the first things that is … Continue reading
Loading malicious Javascript from a “benign” file isn’t a new thing, but using a Font file is. Spotted a WOFF file with a malicious payload in the wild. As we’ve seen before when using a PNG, the file is requested … Continue reading
For the past month or two I’ve been seeing this digital skimmer that I’ve started to call “checkcheck”, based on a function name in the code. It has a number of interesting features.
Digital skimmers will use a variety of infrastructure setups to help hide the real servers. This varies by the script that is being used, but in general you will see three different hosts involved: Host 1 and 2 are sometimes … Continue reading
A lot of skimmers have different levels of obfuscation and code protection built in to hide their actions and protect what they are actually doing. Here’s an example of one with some basic protections. First, the prettified code. On line … Continue reading