Obfuscated code analysis - can unused variables be ignored?

Question

I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the task I put the code to JShint. According to the tool, there are 82 variables that are not used:

Given the context, is it safe to assume that the reason these variables exist is most likely to add to obfuscation but not to fulfill any operation? Would it be reasonable to delete declarations of these variables and have a shorter code to work with?

Answer 1

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated tool with a little grain of salt.

It might be true but it also might be that this code uses non-direct access to those 82 variables.

Having such code:

re = 'testing a variable';
alert(window['re']);

JSHint will tell you that the variable is not used but it is. eval would be another example of indirect usage the linter can miss.

Answer 2

Often then unsued variables are unusued only until you make the first deobfuscation step.

After first run, you could see that some code uses these variables, for example using an eval. This because the previous step of obfuscation make vars look like unusued, only because their use in the code is obfuscated on a (again) previous step.

For example. You could use eval and base64 encoding to hide the use of a piece of code.

In a situation like your I tend to remove apparently unused code using IDE tools, then, if the code is still working I can be sure I removed useless fog from the code.

Person opinion: JsHint fall to detect used cars just when JavaScript coding is confused... An alert using window object to access a variable make JsHint blind. Is not a good help for this specific purpose.

obviously you need to run every sort of sandboxing, sw and hw isolation and emulation when you try a malicious code .

Answer 3

This is a little off-topic but if you are about to analyze malware as your everyday job you will find yourself in the situation that you don't have the time to deobfuscate every script you will stumble upon.

I highly suggest you make yourself familiar with - for example - SpiderMonkey (https://blog.didierstevens.com/programs/spidermonkey/).

Also have a look at How to deobfuscate an obfuscated javascript file like this? which might guide you to the right direction.