Wiping Out a Malicious Campaign Abusing Chinese Ad Platform[html]
At FireEye Labs, we have discovered another well-crafted malvertising
campaign that uses the ad API of one of the world’s largest search
engines: China-based Baidu. The attacker employs a simple HTML
redirector instead of shellcode or an exploit in an apparently
benign-looking website. This leads to a redirection loop fetching
malicious content from compromised ad slots, which starts dropping
malwares in a chain on the infected machine. This malvertising
campaign involving Baidu’s API has been designed in a way so that its
actual source is hard to trace back.
The campaign was first seen in the middle of October 2015, and
instances of the threat were still active as of February. Baidu took
several steps to address the issue following FireEye’s responsible
disclosure, but at the time, Internet surfers who navigated to an
infected page for this campaign – such as hxxp://www.duds[.]win
– would be redirected to the following URL:
hxxp://www.ymnemh[.]info/index.htm
There are two parts of the obtained response.
Setting up a redirection loop:
In first part of response, the code creates a number of tracking
cookies using JavaScript, which keeps track of the current time and
number of visits to the page. Said script is given in
Code Listing 1 for reference:
<script>
function getCookieVal(offset) {
