YourService-Live & AdsNet-Work — Website Redirect-Causing JavaScript

Example of JavaScript malware from a third-party domain adsnet dot work

Javascript Redirect

Recently we had a chance to analyse some malware injected in the database. Malware injected into the database is tricky to catch for several reasons firstly because most malware scanners skip the database scan or only support a partial scan of the database. Secondly, it’s not just possible to know if a piece of code in the database is actually malware unless you can decode it or match it against known malware signatures.

Table of Contents

  1. The Malicious Code
  2. Symptoms of Malware
    1. See Also:

The Malicious Code

The following piece of malware code was found infected in the database custom_CSS settings of Bold Builder — A WordPress page builder.

encoded malware code

The code would render as is on the front-end in the source-code of the page. However as you can see, it has two distinct lines.

Here’s what the first line decodes to:

decoded malware code

As you can see, it loads a JavaScript malware from a third-party domain adsnet dot work.

Here’s what the second line decodes to:

decoded malware code

Symptoms of Malware

And as you can guess from the behaviour of the previous malware snippet, this on loads a JavaScript malware from a third-party domain yourservice dot live.

Comprehensive Guide to Removing JavaScript Redirect Malware from WordPress

Both end-up triggering a malicious JavaScript redirect for the website-visitors landing them to rogue sites. Not only that, when a user with administrative privileges tries to access the site, the script triggers creating a new user allowing privileged access to the site to the new illegitimate user.

One of these scripts also ends up redirecting search-bots like Google etc. This eventually results in reindexing the site and a loss of search engine ranks thus website traffic.

See Also:

Written by
Principal Security Researcher, Malcure Web Security

Shiv has worked in security and infrastructure since 2002, with hands-on experience across enterprise network security, incident response, problem coordination, triage management, Windows and Linux systems provisioning, scripting automation, Nginx, ModSecurity, reverse proxies, web application firewalls, WordPress malware removal, malicious redirect cleanup, SEO spam remediation, WP-CLI workflows, vulnerability response, and website hardening. His research informs Malcure’s malware detection, cleanup, and hardening methodology.

Need help with restoring your hacked site?

Our dedicated incident response team, state-of-the-art technology, and excellent customer service makes sure that your website is 100% clean and secure.

Request Malware Cleanup →