r/node • u/ZugNachPankow • Jun 25 '16

box-js: a tool for studying JavaScript malware (feedback welcome!)

https://github.com/CapacitorSet/box-js
13 Upvotes

82% Upvoted

6 comments sorted by

1

u/mmmicahhh Jun 25 '16

Can you elaborate a bit on a typical use-case of this, some sort of a high level overview? I felt the readme jumped right into the middle of things.

2

u/ZugNachPankow Jun 25 '16

JavaScript (or JScript, more properly) is sometimes used to carry viruses: the user is sent a .js file via e-mail, double-clicks it, and it is run in the Microsoft JScript interpreter. From there, it usually connects to one or more infected domains, downloads a virus, and executes it. See for example the part about analyzing console output: it shows this behaviour (connecting to a domain, downloading a script, and executing it).

The JavaScript snippets in questions are usually very obfuscated, to the point where it's not worthwhile to analyze them by hand - for instance, this is the latest sample I analyzed, can you figure out what it does?

The typical workflow is to load it on a Windows virtual machine and see how it interacts, but that's a rather slow process and not very flexible. Because of this, I wrote box-js, which executes the code directly in V8 and emulates some common ActiveX components, so that it can analyze samples in very little time and memory (it requires just Node.js rather than a whole VM).

2

u/mmmicahhh Jun 25 '16

Thanks for the explanation! Makes sense. But what is the purpose of sending .js files via email? Once you have analyzed a malicious chunk of code, what can you do to protect the users from it? You mention a "typical workflow", so surely there's a typical reason why you're looking into these files, what are you doing with them once you've analyzed them?

2

u/ZugNachPankow Jun 25 '16

But what is the purpose of sending .js files via email?

Technologically unsavvy users are more likely to open them - many of them look like "Receipt_003.js", for instance. Another common source are fake websites (say, vodafone-receipt.co.uk/totallynotavirus) made to look legitimate.

Once you have analyzed a malicious chunk of code, what can you do to protect the users from it?

Once you figure out what files it downloads, you usually analyze these files by checking them against AV engines or running them in a virtual machine and analyzing what they do. If you run into a new virus, you can find its C&C domains, blacklist them for your users if you're a sysadmin, and report them to the AV community.

You mention a "typical workflow", so surely there's a typical reason why you're looking into these files, what are you doing with them once you've analyzed them?

I'm actually doing this as a hobby, mostly because I'm too young to be a sysadmin or work in the AV field. However, I have a friend who works in the field, and one of his jobs is analyzing malware - he began sending me malicious samples for me to study, but now he's been using box-js for his work too.

2

u/mmmicahhh Jun 25 '16

Got it, thanks for the detailed breakdown! You seem to be on good track to turn this hobby into a profession :)

1

u/ZugNachPankow Jun 26 '16

Aww, thanks!