Hiding Data In Bases

One way that a spear phisher or malware writer can get around detection is to hide data in a different encoding format, such as hexadecimal, octal, or binary. These can involve different character set, and using a different base. For example, Base-3 encoding uses a character set of “123”, and Base-5 uses “01234”. And, so, while Base64 is well known, there are many other bases we can use. Oh, and did you know that Satoshi Nakamoto selected Base58 for Bitcoin, as it removed those pesky printed characters of “I” and “O”.

Malware can use scrambled JavaScript to trick scanners. In this example we have an email with a ZIP attachment. The initial email tries to panic the user with the threat of a court appearance:

So when we open the ZIP file, it’s a JavaScript file:

Basically this a scrambled JavaScript file which hides the actual JavaScript code. It uses standard obfuscation methods, such as deleting newlines, splitting the JavaScript into small chunks, encoding the data in different formats, and randomising the order of the…