Interesting or Suspicious Ads?

15-07-2023

Last June, on the 14th to be exact, I was scrolling Facebook and found an interesting ad about Google’s AI called Bard. What made it even more interesting was the comment section, so I immediately checked the comments.

verified accounts

Why were all the commenters verified blue check accounts? Why were Indonesian politicians commenting on it? What does politics have to do with Google Bard? The comments also showed mostly positive sentiment.

When checking the website link, it turned out to be hosted on sites.google.com, a Google service where anyone can create a website using the sites.google.com subdomain. There was also a download link hosted as a Trello attachment, and the file was a password protected zip file with passwords like 888 or 999.

google site

Out of curiosity, I downloaded this so called Google Bard. It contained an installer. I tried running the installer on any.run but found nothing suspicious.

any run result

Since the result from any.run did not fully satisfy my curiosity, I analyzed the installer file using Malcat. It contained several embedded files, but two were particularly interesting: a CAB archive file and a PE file. I dumped these two files from the MSI installer.

malcat

From the CAB file, there was a BAT file that reloaded Chrome with a specific extension. It turned out that the extension loaded into Chrome was the CAB file itself. The file structure looked very similar to a typical Chrome extension, including a manifest.json file. The malware disguised itself under the name Google Translate.

cab

batfile

manifest

Inside the CAB file or extension, there were several obfuscated JavaScript files. After deobfuscating them, it was clear that the script was designed to collect data stored in the browser, especially Facebook account data. It also added the attacker’s account to Facebook Pages access control, hijacked the victim’s Facebook account, changed the account name to Bard Google or similar, and posted similar malicious ads along with comments.

steal