Ricevo la posta da cron ogni giorno e non riesco a identificare la fonte

Non posso aiutare con perché questo sta accadendo. Ci potrebbero essere troppe ragioni. Tuttavia, posso dirti cosa sta facendo:

Ha una grande lista di numeri ( var b ) che sono in realtà codici di caratteri memorizzati. Il programma li divide in var z in questo modo:

116,114,121,123,118,97,114,32,120,104,114,59,118,97,114,32,116,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,59,118,97,114,32,115,116,97,116,117,115,61,34,115,116,97,114,116,34,59,118,97,114,32,116,105,109,105,110,103,61,110,101,119,32,65,114,114,97,121,40,51,41,59,119,105,110,100,111,119,46,111,110,117,110,108,111,97,100,61,102,117,110,99,116,105,111,110,40,41,123,116,105,109,105,110,103,91,50,93,61,34,114,58,34,43,40,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,41,59,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,105,109,103,34,41,46,115,114,99,61,34,47,95,73,110,99,97,112,115,117,108,97,95,82,101,115,111,117,114,99,101,63,69,83,50,76,85,82,67,84,61,54,55,38,116,61,55,56,38,100,61,34,43,101,110,99,111,100,101,85,82,73,67,111,109,112,111,110,101,110,116,40,115,116,97,116,117,115,43,34,32,40,34,43,116,105,109,105,110,103,46,106,111,105,110,40,41,43,34,41,34,41,125,59,105,102,40,119,105,110,100,111,119,46,88,77,76,72,116,116,112,82,101,113,117,101,115,116,41,123,120,104,114,61,110,101,119,32,88,77,76,72,116,116,112,82,101,113,117,101,115,116,125,101,108,115,101,123,120,104,114,61,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,34,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,34,41,125,120,104,114,46,111,110,114,101,97,100,121,115,116,97,116,101,99,104,97,110,103,101,61,102,117,110,99,116,105,111,110,40,41,123,115,119,105,116,99,104,40,120,104,114,46,114,101,97,100,121,83,116,97,116,101,41,123,99,97,115,101,32,48,58,115,116,97,116,117,115,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,58,32,114,101,113,117,101,115,116,32,110,111,116,32,105,110,105,116,105,97,108,105,122,101,100,32,34,59,98,114,101,97,107,59,99,97,115,101,32,49,58,115,116,97,116,117,115,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,58,32,115,101,114,118,101,114,32,99,111,110,110,101,99,116,105,111,110,32,101,115,116,97,98,108,105,115,104,101,100,34,59,98,114,101,97,107,59,99,97,115,101,32,50,58,115,116,97,116,117,115,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,58,32,114,101,113,117,101,115,116,32,114,101,99,101,105,118,101,100,34,59,98,114,101,97,107,59,99,97,115,101,32,51,58,115,116,97,116,117,115,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,58,32,112,114,111,99,101,115,115,105,110,103,32,114,101,113,117,101,115,116,34,59,98,114,101,97,107,59,99,97,115,101,32,52,58,115,116,97,116,117,115,61,34,99,111,109,112,108,101,116,101,34,59,116,105,109,105,110,103,91,49,93,61,34,99,58,34,43,40,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,41,59,105,102,40,120,104,114,46,115,116,97,116,117,115,61,61,50,48,48,41,123,112,97,114,101,110,116,46,108,111,99,97,116,105,111,110,46,114,101,108,111,97,100,40,41,125,98,114,101,97,107,125,125,59,116,105,109,105,110,103,91,48,93,61,34,115,58,34,43,40,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,41,59,120,104,114,46,111,112,101,110,40,34,71,69,84,34,44,34,47,95,73,110,99,97,112,115,117,108,97,95,82,101,115,111,117,114,99,101,63,83,87,72,65,78,69,68,76,61,52,51,53,53,49,50,48,49,48,54,55,53,52,51,54,53,56,44,51,50,50,50,52,54,52,55,57,49,51,53,57,48,57,48,49,50,54,44,55,54,56,51,48,56,54,51,49,49,56,53,53,51,56,57,49,55,51,44,52,50,52,53,54,51,34,44,102,97,108,115,101,41,59,120,104,114,46,115,101,110,100,40,110,117,108,108,41,125,99,97,116,99,104,40,99,41,123,115,116,97,116,117,115,43,61,110,101,119,32,68,97,116,101,40,41,46,103,101,116,84,105,109,101,40,41,45,116,43,34,32,105,110,99,97,112,95,101,120,99,58,32,34,43,99,59,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,105,109,103,34,41,46,115,114,99,61,34,47,95,73,110,99,97,112,115,117,108,97,95,82,101,115,111,117,114,99,101,63,69,83,50,76,85,82,67,84,61,54,55,38,116,61,55,56,38,100,61,34,43,101,110,99,111,100,101,85,82,73,67,111,109,112,111,110,101,110,116,40,115,116,97,116,117,115,43,34,32,40,34,43,116,105,109,105,110,103,46,106,111,105,110,40,41,43,34,41,34,41,125,59

Dopo, cerca di ottenere il codice del carattere per ogni numero nella stringa. Ad esempio, carattere 32 = spazio. Questo produce il seguente output:

   try {
       var xhr;
       var t = new Date().getTime();
       var status = "start";
       var timing = new Array(3);
       window.onunload = function() {
           timing[2] = "r:" + (new Date().getTime() - t);
           document.createElement("img").src = "/_Incapsula_Resource?ES2LURCT=67&t=78&d=" + encodeURIComponent(status + " (" + timing.join() + ")")
       };
       if (window.XMLHttpRequest) {
           xhr = new XMLHttpRequest
       } else {
           xhr = new ActiveXObject("Microsoft.XMLHTTP")
       }
       xhr.onreadystatechange = function() {
           switch (xhr.readyState) {
               case 0:
                   status = new Date().getTime() - t + ": request not initialized ";
                   break;
               case 1:
                   status = new Date().getTime() - t + ": server connection established";
                   break;
               case 2:
                   status = new Date().getTime() - t + ": request received";
                   break;
               case 3:
                   status = new Date().getTime() - t + ": processing request";
                   break;
               case 4:
                   status = "complete";
                   timing[1] = "c:" + (new Date().getTime() - t);
                   if (xhr.status == 200) {
                       parent.location.reload()
                   }
                   break
           }
       };
       timing[0] = "s:" + (new Date().getTime() - t);
       xhr.open("GET", "/_Incapsula_Resource?SWHANEDL=43551201067543658,3222464791359090126,7683086311855389173,424563", false);
       xhr.send(null)
   } catch (c) {
       status += new Date().getTime() - t + " incap_exc: " + c;
       document.createElement("img").src = "/_Incapsula_Resource?ES2LURCT=67&t=78&d=" + encodeURIComponent(status + " (" + timing.join() + ")")
   }

... e poi prova a inviare informazioni a un sito web.

[segue l'hattery di tinfoil

Questo sembra essere legittimo, ma ...

Sei un utente normale o sei l'amministratore? Se sei l'amministratore e non sai perché questo è lì, allora non mi fiderei di questo. fa riconduce a una società apparentemente legittima che fornisce soluzioni di sicurezza IT, Incapsula. Tuttavia, metto in discussione qualsiasi società che trova la necessità di andare a tali lunghezze per offuscare il loro javascript. Secondo me, qualsiasi azienda degna di questo nome non proverebbe a fare ciò in quanto mi ci sono voluti solo 30 secondi per sbrogliare.

Questo però non funziona affatto. Sembra che stia cercando di incorporare un'immagine, che può anche essere utilizzata come cookie di tracciamento per ogni email che invii . Ogni volta che carichi o scarichi la pagina, incorpora un'immagine di tracciamento.

Troppo lungo, non letto

1. Converte una stringa di numeri lunghi in una stringa di numeri separati.
2. Converte una stringa di numeri separati da virgola in codici carattere ASCII
3. tenta di eseguire uno script utilizzando eval() incorporato. Sembra indirizzare l'utente in base al proprio browser web specifico (primi tag <script></script> ).
4. Crea un XMLHttpRequest, o oggetto ActiveX (!)
5. Ogni volta che l'utente carica il file, visualizza i contenuti come un'immagine. Questo può essere utilizzato per scopi di monitoraggio.
6. Ogni volta che chiudi la finestra, fa lo stesso. Sanno quando apri la finestra e quando chiudi la finestra.