Hot answers tagged

65

The title mentions "sandbox" but VMWare or QEMU is usually not called that, so the question seems to be more about "how do I analyze it without a danger of infection?" There are three broad categories of tools and approaches you could take here. 1. User-mode sandboxes A user-mode sandbox basically runs the sample being investigated but intercepts all or ...


36

I am the author of JSDetox, thanks to Jurriaan Bremer for mentioning it! As already said every obfuscation scheme is different. JSDetox does not try to deobfuscate everything automatically - the main purpose is to support manual analysis. It has two main features: static analysis tries to optimize code that is "bloated up", e.g. statements like var ...


22

Bochs if you don't need speed but lots of flexibility. You can use Bochs with GDB. Qemu if you need more speed and less flexibility (it does dynamic translation so you gain bit of speed but lose the acutal sequence of the instructions) possibly a bit less safe than bochs. Its similar to Vmware and virtualbox actually derives from it. You can use GDB with ...


17

I'm a fan of Malzilla and its embedded SpiderMonkey JS engine which allows you to decode malicious javascript. Here's a tutorial using Malzilla to decode a LuckySploit attack. You can download the pre-built binary for Malzilla on SourceForge, here.


15

Gilles provided some great links and I want to discuss the use a virtual machines for malware analysis a bit more. While a VM breakout certainly is a possibility, I have yet to come across such a case or even heard about one and I assume this would make some buzz should someone find one. To be safe, simply run your VM software on an isolated computer and ...


11

Your best bet is to use an environment (eg FireFox) in which eval() can be overridden by using a proxy function, and the function just prints the output. That way, there is no risk in missing anything, even if the malware aliases it. Unfortunately, eval() is not designed to be overridden (and I believe is explicitly forbidden by recent ECMAScript spec), ...


9

Well, after online tools, You may use Revelo by KahuSecurity http://www.kahusecurity.com/tools/Revelo_v0.5.1.zip It's have less automation in process, but more powerful in de-obfuscation of customized js. Documentation is included in ZIP, you also may see examples of it's usage in Kahu blog as well: http://www.kahusecurity.com/ p.s. don't forget to use VM!


7

Literally, for a first look on malware, you won't need anything special locally installed. There are enough online sandboxes you may use: virustotal.com have their sandbox implemented using Cuckoo Sandbox. When you apply new sample, it automatically executed as part of analysis. After about 10-15 mins you can see the result in "Behavioural information" ...


7

You might be lucky trying either JSDetox, http://www.relentless-coding.com/projects/jsdetox, which is an automated javascript+html unpacker in Ruby, or my own library which is work-in-progress and only supports javascript (but does a bit more than JSDetox), https://github.com/jbremer/jsunpck. For JSDetox you can give the html as input through the ...


6

Well, personally i would either use JSDetox (http://relentless-coding.org/projects/jsdetox) if i'm feeling lazy to analyse it manually. It's probably one of the better tools out there.


6

For learning purposes, I would recommend you the following Github projects to start with: Paranoid Fish by a0rtega https://github.com/a0rtega/pafish Al-Khaser v0.60 by Noteworthy https://github.com/LordNoteworthy/al-khaser or Colection by AlicanAkyol https://github.com/AlicanAkyol/sems Grab one you like, compile and analyze. In case you look for in ...


5

You might try http://jsunpack.jeek.org/ which works for some stuff. I personally just use Chrome's built-in JS console in a VM, replacing eval()s. This might be helpful too, although it is more for improving readability.


4

In addition to the other useful links here, I recommend to try Malware-Jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript (Windows Scripting Host) context env/wscript.js, at least the part frequently used by ...


3

I want to know how to test malware files with out using virtual environment. Check out the answers in the following, similar, question: Analysing malware in a real environment (non-virtual environment) TL;DR: Check out Faronics Depp Freeze for example. I recommend reading the answers as a whole. In addition, read the answers to the following question on ...


1

The following call stack can be found in MrmCoreR.dll: Microsoft::Resources::MetroAppClientProfile::IsUnsafeLoadPriFileAllowed Microsoft::Resources::HasCapability RtlCheckSandboxedToken Seems like it's used by Metro applications to know if they were run in the sandbox. And RtlCheckSandboxedToken() checks the token if it can be accessed via some specific ...


1

Use KVM. Most of the time malwares will try to detect VMWare and Virtualbox based artifacts.


1

If you are analyzing ELF binaries, then the open source online sandbox detux may prove useful: Detux is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so. Detux logs network data including IP addresses the program sends signals to, DNS queries, URLs accessed and TCP raw streams: If you are performing ...


1

https://github.com/a0rtega/pafish is old but it is good tool. https://github.com/AlicanAkyol/sems is current. You can use it.


1

For the last year I've been developing box-js, and I found it to be the most accurate tool when analyzing JScript droppers. Internally, it uses UglifyJS2 to run a static analysis and simplify many obfuscation techniques; the rest is achieved through emulation in a V8 sandbox.


Only top voted, non community-wiki answers of a minimum length are eligible