Hello and welcome back.
In this particular lapsation, we will take a look at how we can try to manually obfuscate this Chalco
or these JavaScript, which we have extracted from that PDF.
We will first try to do it manually and then we will use the spider monkey to try to extract it.
So as you can see from the previous Neston, typically.
Obfuscation can be any of these four or in combination, as you can see, the random name has no meaning,
and then here you see an escape function.
In JavaScript, Unnice is used to decode sequences of encoded strings like this.
So in here you can see device and this signifies that these are all Unicode and kind of skip is intended
to decode it.
So this suggests that this could be Chalco.
So because we expect this to be Shakal, we can rename this part here as a meaningful name, so radically
change our occurences and Chalco.
And now when you're winning this, you will see the same thing we rename in all the occurrences you.
And then the second line here, you can see that this is not slight.
An escaped 1998 and not so enough slight is using Chuck-will's-widow, and you can read all about it.
Even by Googling for you here not to use in a sequence of instructions, men dislike this instruction
execution flow to his final design destination.
You don't really need to know this detail, but whenever you see nineteen like this being added to the
anxiety, how good you can be sure that this is most probably not a.
So if you suspect this to be another slide, we can just rename this to something meaningful, theoretically
can be nameless and you can call it Oxly.
Right, click and change all occurrences, and Colley's no slight.
And here you can put it down into another line, became more reliable.
And over here you can see that this variable he's holding 20 Chalco length.
So we can rename this Hesseldahl.
So Reichling, this change on occurences, call it Chalco plus 20.
And then down here, you can see further that there's a while we're trying to build the site to build
a shortcut by adding up slides.
Now, if you keep looking for there, you will see another volume over here.
And this wall is taking this data here and in trying to sell concatenation over here, as you can see.
And he takes this data and a pencil itself to itself again.
And this is quite typical in constructing a shortcut and it exploits shortcuts are normally being used.
So the purpose of this is so that when this runs, you do not return to an exact address, but sufficiently
before forced into any of the norm that we injected using the obviously you don't need to know that
in detail, but just enough to understand what is in meaning, what is just trying to do.
And that should be sufficient.
So this is the manual we are trying to do with JavaScript, which is obfuscated.
But there is an easy way.
Instead of going through this line by line trying to make sense, we can allow this to execute and try
to let the obfuscated sell.
So to do that, you can use to which I introduce to you in the previous method, which is the modified
spider monkey.
So that is open terminal here and go to our location of the malware.
And then over here, this is our target, JavaScript, we can use our modified spider monkey to directly
run the JavaScript file.
All right, so we see nothing happening immediately.
Chris, why does that happen?
That happens because this JavaScript does not have an entry point.
This is a function, but nothing is calling a function.
So we can write our own function, call inside here to do that and we can just copy this line.
And put it down, here it is, semicolon and save.
Now we can run it again and see what happens.
So this time it is trying to execute it, and if you get a reference here that is not defined, so callup
is coming from 930, KOLLAR is not define.
OK, so that is quite OK.
The important thing is we are trying to cut the shark here and see what it actually is.
So what we can do is introduce an additional coating here to drum up the memory content of memory after
this thing has been decoded so we can document the right, followed by the Shalakany.
So now we save it and you come back here and we execute the command.
All right, this time we put a listing and we see that there are new files being created right.
And been long, right.
Law and U.S. law.
So these three files contain the binary representation of the Chalco and the ASCII representation,
as well as a unique representation.
And these three files are coming from this destruction here, right document, right, Chalco.
We will first take a look at the binary version of the Chilkoot, so to do that, we can examine in
hex them Hexton.
With the caution so that we can see the sky, her presentation as well,
enter, you see, this is the content of the binary of the Chalco.
So on top here you see all the the executable instructions in Netty format.
And down here you will see something interesting.
HTP, you are ill and this could be the indicator of compromise.
Then you go looking for.
So indicators of compromise is and allow them to refer to some evidence of proof.
Then the machine is being infected by malware.
So this is a good sign.
All right, now, this is pretty hard to read, so we can you can comment on the on the binary file,
so strings, right, being lost and you pull all the strings they find in a binary file.
And as you can see clearly here, that this is you are ill, that this Chalco is trying to do to reach
out to and he runs and he's probably trying to reach out to this area and download the secondary payload
for this malware.
And this is good enough for us to conclude that this is an indicator of compromise.
And we can go ahead and look now in our organization to see if anybody has already reached up to this
website.
And you can even put a firewall to block access to E to this Web site.
And that should be good enough to conclude in this analysis so that we have successfully done the analysis
for this malware document.
Thank you for watching.
I'll see you in the next one.