Hello and welcome back.
In this video, we are going to talk about the principles of performing JavaScript analysis.
We are going to take a look at malicious groups and the users malicious JavaScript script obfuscation
and how to defeat obfuscation.
As we mentioned before, PDF, document or any other document can be used to download for the mail.
And this is often used to using embedded scripts, for example, for PDF.
If we have an embedded JavaScript and this JavaScript could take advantage of some exploits in the PDF
reader to execute, quote, they can download for the malware onto the machine.
This can also happen for other kinds of documents, office documents which may contain embedded VBA
scripts that can do the same thing.
And also, we have seen earlier that there are various vectors of attack, for example, a document
that can contain malicious JavaScript or other scripts could be used to download for the malware.
JavaScript can also be sent in via email attachments, and if a user were to open these attachments,
it would trigger the embedded JavaScript to download for analysis that can also be other types of attack
from Web pages.
If a user were to visit certain Web pages there has got embedded JavaScript browser from the user's
machine could inadvertently execute those embedded JavaScript and caused some additional malware to
be downloaded.
So there are certain things we keep on the lookout for in performing JavaScript analysis or any kind
of document analysis for that matter.
And these are you are hours you hours contain the Web site from which the target.
Will be trying to download additional malaby.
We also keep a lookout for commands, for example, commands to execute bauscher, and these commands
can do additional tasks that can cause damage to the machine or even to download further additional
tools.
We also keep a lookout for filenames.
Filenames could be names of the new files which have been downloaded and saved on the target victim's
machine and found this can also contain a path where these additional files are being saved.
Here is an example of a JavaScript, as you can see here, there are several variables being created.
For example, there will be will be used to create an array here.
The string is.
Contains an additional dodgier this javascript means that you are performing a function call on the
string.
So the fashion call in this case is a split function call.
So what it does is it takes the string here and split into two elements of an array based on the separate
sort of separate.
In this case, it space here.
So if that's especially as you can see in the string, this split function will split this string into
two elements, element one containing the first Yorio and element to containing the second Yorio and
put them in an array which is called B.
So B now is an array containing these two strings.
And then further down you can see here variable and is actually containing the string for the user's
temp variable temp environment variable in this time environment variable here is a string containing
the path to the temporary location on the user's machine and it concatenate step with a character string
from charcoaled function with the ninety two as a parameter.
So this ninety-two here is an escort which represents the backspace backslash and then is appended to
the number one zero seven.
So this variable is trying to create a path to store something.
And in this line here, you excel here contains the object which will be used to connect to the Internet.
Same thing we see in this line here.
You can see that this file here is slipping through.
Something starts with zero to the length of the variable, to the length of every so since the length
of the arrays to it is actually looping through two times each time for each string of the array.
And every time we lose through this string, here it is trying to connect to the Internet, be I.
When you lose through the first iteration, I would be zero.
So in the first iteration, is constructing a Yuanchao out of this string here.
And then from there he will call the next line the sand, which is to connect to this.
You are able to perform some kind of download.
And here in an instant when he checks whether the result is successful.
Two hundred is our for successful.
If it is successful, it would then open it, open this line here and down and CV to a file.
And then here is the path which we saw just now containing the complete path to where this fire is going
to be saved.
And the name it is constructed here as well.
It end extension.
And over here, the next line, even as I see once, it has me safe to location.
So this is an example of a malicious JavaScript code.
However, very often we will not find the JavaScript code so easy to read and in plain text, most often
it will be obfuscated and this is probably what we are more likely to see.
He doesn't have any clear formatting.
He has got obfuscation and substitution and knee replacements and so on to make it difficult for the
analyst to understand what is going on.
It's good obfuscation, obfuscation, can you use any of these four or all of them in various combinations?
The first is formating.
That is, he will remove any formating.
That is to make it harder to see to understand the code and then also inject additional unnecessary
code to make it even more confusing.
Then he will also perform data obfuscation by trying to.
Creates strings in various ingenious ways, rather than simply put it out so that people can easily
understand the strings.
And then there's also substitution where the variable names will be replaced by junk collectors who
junk names.
So that is difficult to understand the function of a particular variable.
Formatting, so this is first obfuscation method formatting, this is an example of formatting, obfuscation,
so on the left you can see it is clearly, easily formatted for e for someone to programmer analyst
to read.
And this is easy to understand on the right of formatting has been replaced and all we see is just a
junk blob of characters, which is almost impossible to understand.
The solution of who overcome this kind of formatting obfuscation is the use beautification programs.
So communication programs will be able to reformat this and make it formatted nicely as shown.
And the left.
So this is an example of a court which has got formating removed after applying the beautification process
to it.
It is now much easier to read.
As you can see here, there is a clear indication of a follow up here and there's a block here and within
this if statement as well.
The second way, in which case it can happen is through injecting extraneous code and then means two
extra lines of code in order to confuse the analysts, for example, here on the left.
This is the original quote.
And on the right, you can see unnecessary code has been added to make it difficult to read, to understand.
As you can see here, the important parts of the code is random on one, assign ten random to assign
five and one and three is assign them one plus two.
However, in between you can see additional extraneous could be injected.
For example, here, which is assigned ten by plus 10, the assigned one, two, three, three, four
and six assigned by the line.
So this is A, B and C are unused at home.
So the solution to overcome these kind of extraneous obfuscation is to search for variables and code
that is only used once and to remove them from the code.
Take a look at our example here in this example here, you will see a lot of unnecessary corn being
injected.
Now, these are the unnecessary could we use.
Only once and never use again any.
So these are meant to confuse and unnecessary complexity to the court after we have removed them, you
will see the courtly, smushing, eternal and shorter.
Another example is data obfuscation.
This technique is where we use corporations to make data unreadable or confusing, for example, in
these two lines.
Here you can see the original lines are as follows.
But after going through data officiation, you will see that the first line now is being complicated
further.
So what it does is it is still trying to correct the string if you end, but it is doing so by injecting
unnecessary operations into the line.
For example, here it is concatenating blank character to F, and here it is converting his representation
of ASCII from a charcoal function, which actually would be you.
And finally, the end here.
He's continuing to do it, and anything less than 100 years will be split up into a complicated mathematical
operation to make it difficult to understand.
So the solution for this kind of escalation is to replace all these unnecessary operations with readable
values.
That means you have to go through manually all of this and then replace it to to get back his original
simplified form.
Now, this is another example I saw earlier, and you can see here that all these lines here be 1990,
1998 and so on, when you come to the front line is being replaced.
So what is doing is taking all this string here and wherever you find any stage and contains any name,
you removed any name.
Now, if you want to replace all this unnecessary operations, we would end up with something like this.
So this is what you get after removing all the data obfuscation and you can see that it is much easier
to read.
Another method for confusing the data analyst is a use substitution.
Substitution is where you modify the variable names to random names, meaningless names.
For example, on the left you see that this variable password from reading the name of the verb.
Yet we can clearly understand that use purposes to start with.
But on the right it has to be replaced if a random string, which has no meaning at all.
So the purpose of this is to obfuscate, make it difficult to understand.
Now, in order to to overcome this kind of substitution obfuscation, we need to analyze to find the
meaning of the variable.
And once we found the meaning of it, we should then go on to search for all the similar variables and
replace them with something meaningful.
So let's take a look at how this is used in practice.
Coming back to our example over here, we can see that if we were to replace only meaningless verbal
names in meaningful names, our code now becomes much easier to read.
As you can see, NIST has no meaning at all, but maybe replacing meaningful words.
We can see that now things begin to make sense.
The same thing with second character here.
Any SGI you replace him is the meaningful variable names.
It begins to make sense that.
So the same thing applies to all the other meaningless variables, we just have to replace them with
meaningful names.
So he has some tips to help you with the obfuscation process one layer at a time, although there are
four possible ways in which far can be off with gated only select one at a time.
And technically second, try to reform the court so that he has proper indentation in spaces so that
it is easier to read and understand that we can try to execute the malicious code in a sandbox.
There is a virtual machine and then once it's executed, the court itself or the office carousel, and
then we can be able to dumb the obfuscated version from memory and examine the obfuscated code.
So this is much easier than trying to manually try to the obfuscate the various quote.
One example of a tool we can help us do that is the PDA, which we have seen before in some previous
lesson.
And people can beautify and execute JavaScript in a sandbox.
And these two, as you have seen already, come to us.
And we have used it before.
And this has sounded in line commands that we can use in order to perform content, beautification and
good analysis.
Another useful tool is as needed and united here to keep from Mozilla implementation of JavaScript.
So this author has taken this JavaScript implementation and created some useful tool that can do the
obfuscation for us.
Some of the JavaScript functions like eval document done right and Vendig navigate our use by script
when you finish with the idea of education process.
And so this too takes advantage of these functions in order to be able to dump out the obfuscated code
for further analysis.
So that's all for this lesson.
Thank you for watching.