TO ISEC Labsre: w***wet bug PoC with fixing ADVICE

// As promised to Mr. Marco Cova, I did send the email below
// regarding to the w***wet bug of PseudoDomain multilayer+packer obfuscation scan.
// Ref: http://malwaremustdie.blogspot.jp/2012/10/fuzzy-in-manual-cracking-of.html
// Looks like he cannot receive email from GMAIL I don't know how to contact so I pasted
// the report here instead, and tweet the bug to him.

Delivery to the following recipient failed permanently:
========================================
     [email protected]
========================================
Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 Encrypted zip attachments are not allowed (state 17).

----- Original message -----

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        bh=Dw9pzl4ZPN/QK1b6xi4EC8L7l2odRNM+Ymv0gkLNgQY=;
        b=xiB+7bNu8mJCyJkiqejh5Z/HjwlPrY4j6/mWh3PRJ7I0sVFxvcJJInfaiXj1pcI3Xw
         ZA5zp3p59eGFqRCr5OajcNe8AR+Wy4ACd0zA85PgGR5VKH7yA02IS8SEjKhL70+O+dsT
         Y4jQJNkB9qNk8qNlRgeCHBKeG/l4xl70xhRoyikUxqE7zsOSH83clxK4wQumYc9Ujm6R
         kHF0fG5Gizb5GlgzmMVqCB+YREjByfh6R8ZjxSF9Gx6pjNVa7QfYCSEWWhU5qI1F+JBo
         KEdRMg7mPsB5RMO3Y7HAwOf2rK0Mp8RUp2usZTZwIjmw01jBiwzizoiLkcnhlDkFFR0f
         EMSQ==
MIME-Version: 1.0
Received: by 10.224.176.201 with SMTP id bf9mr583304qab.80.1350648059201; Fri,
 19 Oct 2012 05:00:59 -0700 (PDT)
Received: by 10.49.87.71 with HTTP; Fri, 19 Oct 2012 05:00:58 -0700 (PDT)
In-Reply-To: <CAAhuQpNgR15GE1U2PVbGwZ1GqTXJEK3fMeBG84s69eq_WY5g2w@mail.gmail.com>
References: <[email protected]>
        <CAAhuQpNgR15GE1U2PVbGwZ1GqTXJEK3fMeBG84s69eq_WY5g2w@mail.gmail.com>
Date: Fri, 19 Oct 2012 21:00:58 +0900
Message-ID: <CAAhuQpMSzb=Pykecs-9dWsazepnYkhYRs1Lyoq+4uv+11V87Rg@mail.gmail.com>
Subject: Re: wepawet
From: =?ISO-2022-JP?B?GyRCJSIlSSVqJSIlcyVYJXMlSSVqJUMlLxsoQg==?= <[email protected]>
To: Marco Cova <[email protected]>
Content-Type: multipart/mixed; boundary=20cf30334e41c907e004cc6841b6

Hello Mr. Cova,

Allow me to report the obfuscation that cannot be cracked well by wepawet.
The infected files contains the obfuscated JavaScript is as per attached
index.html.zip/pass: infected.

It is an obfuscation of the Pseudorandom JavaScript which is currently used
by some Exploit Kit malware infectors as per described
here<http://malwaremustdie.blogspot.jp/2012/10/fuzzy-in-manual-cracking-of.html>
But this time this "thing" was obfuscated 2 times, get packed one time
(with what so-called JS/Packer that often being used by these malware
makers) and get obfuscated again.

The result of the current scan is as per below url in wepawet:
http://wepawet.iseclab.org/view.php?hash=000bcb872c056f3702e80cab6dbbfeb6&type=js&t=1350578657

Interesting part of it was the message shown in the result as per pasted
below:
===============================

Malware

*No additional malware was retrieved.*
================================

↑ the above statement is wrong, we received the exploit kit payload as per
desribed in our blog, the messages can make other developer thinks a non infected
page... Please fix the wepawet logic regardingly.

---------------
@unixfreaxjp
#MalwareMustDie!
http://malwaremustdie.blogspot.jp