Malware Signatures

  1. Home
  2. Malware Signatures
  3. js.spam-seo.hidden-iframe.004

js.spam-seo.hidden-iframe.004

Blackhat SEO is a malicious technique used to manipulate the search engine results in order to benefit a website in terms of relevance.
Hidden IFRAME is one of the most common malware type. This kind of injection is usually very small, thus hard to notice and any other malicious content can be loaded via such iframe. The malware creators are usually hiding it via css properties using techniques such as negative positioning, but very common way is injection of obfuscated JavaScript code which purpose is not very clear and is hard to decode. Such JavaScript code is responsible for hiding the iframes or other page elements.

Affecting

Any vulnerable website. Outdated software or compromised passwords can act as an infection vector.

Cleanup

Inspect your files looking for the hidden iframes or any code that you do not recognize. Also, you can contact Sucuri to help you with the infection removal.

Dump

<div id="linkm">
<ul>
<li>
<a href="http://----.-------.cn/dianxian/bjjryy/">
±±Ÿ©Ÿ©ÈÊҜԺ
</a>
</li>
<li>
<a href="http://www.--------.cn/jkbk/sxkjyy/">
Î÷°²¿µœÜҜԺ
</a>
</li>
</div>

slightly obfuscated JS code which purpose is to hide this page element:

var _$=["x6cx69x6ex6b","x6d","x6ex6f","x6ex65"];document.getElementById(_$[0]+_$[1]).style.display=_$[2]+_$[3];

deobfuscated:

var _$=["link","m","no","ne"];document.getElementById("linkm").style.display="none";