Malware Analysis - 3 ways to deobfuscate JScript and JavaScript malware
Channel: MalwareAnalysisForHedgehogs
Date: 2023-12-26

We use abstract syntax tree manipulation, regex search and replace and dynamic analysis to deobfuscate and unpack GootLoader. Each method has its own pros and cons.
GootLoader is an initial infector written in JScript. Current samples feature up to five layers of packed and obfuscated code.

Malware Analysis course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=02F3FAD5E2153D4D789E

extract called functions: https://github.com/struppigel/hedgehog-tools/tree/main/ECMAScript%20helpers
gootloader unpacker: https://github.com/struppigel/hedgehog-tools/tree/main/gootloader
sample:  https://bazaar.abuse.ch/sample/1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f/

Follow me on Twitter: https://twitter.com/struppigel

00:00 Introduction
00:26 First Layer - extract relevant functions
07:24 Regex deobfuscation
14:05 Abstract syntax tree transformations with babel
30:57 Dynamic deobfuscation
40:46 Deobfuscation method overview
41:43 GootLoader unpacker

#javascript #deobfuscation #gootloader #malware #malwareanalysis #unpacking #reverseengineering #js #babel #jscript