1

I am analyzing a malicious JS file, which is obfuscated in a way that I could not de-obfuscate. When I executed it in a virtual machine and spectated process changes, I noticed that a new executable was created, which when acquired, turned out to be written in Visual Basic 6.

I know that JS droppers often are written to download the secondary malware but in this case, the exe is created without any network communication. Does that mean that the VB6 exe was packed in the original JS file? On a high level, how can this be implemented?

0

The executable is most likely embedded inside the javascript file itself, or of any accompanying files (say, an .html file that is downloaded with the javascript).

As Memo mentioned, the embedded executable can be encoded, obfuscated or even encrypted within the javascript file, where the javascript file will be required to decode, deobfuscate or decrypt it before writing it to disk and executing it.

  • 1
    Downvoters, please share any issue with the answer – NirIzr Aug 23 '18 at 14:09
0

Most probably the VB6 executable was base64 encoded and embedded as a string in the obfuscated code. Then decoded back into a binary at runtime.

https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.