Sunday, October 7, 2012

Diving into recent 0day Javascript obfuscations

Introduction

One of the most common ways for an attacker to infect system over the Internet is using Javascript. Typical Web exploitation frameworks like Blackhole utilize polimorphic Javascript as a personalized payloads for every victim. By employing various obfuscations they are able to evade static signatures and reduce anti-virus detection rates.
In this post we will analyze one of such Javascript obfuscators called Dadong's JSXX that was used to obfuscate the payload of a recent Java 0day (CVE-2012-4681) exploit that was found in the wild and has since been patched by Oracle and it is recommended that you apply the security patch to ensure maximum protection.
DefenseCode BlackTitan Internet Security customers are protected from described exploit with BlackTitan malware signatures BTSIG9612, BTSIG9613 and BTSIG9615.

Analysis of Dadong JSXX obfuscated payload

Let's first take a look at the fully obfuscated JavaScript code that is generated by the attacker. The following code is generated by the attacker for each visit of the web page serving the exploit which is then responsible for exploiting Java vulnerability and installing malicious software:


First thing we can notice is that this code was not designed to be easy to understand and analyze. In fact it is designed to thwart static analysis and automated deobfuscation tools so that it can stay undetected longer.
While looking at the obfuscated code several things become obvious:
  • Code alignment and flow structure is not preserved
  • Original variable and function names are replaced by random strings
  • Various additional obfuscations introduced to additionally deter analysis
To get a better understanding of the code we will tackle all of the mentioned observations in a attempt to fully understand it.

Recovering code alignment and flow structure

Most development editors and environments have basic code prettify functionality that will allow you to format code into a more readable structure. Malzilla is described as a "malware hunting tool" and has ability to format obfuscated javascript code into a much nicer layout. Some manual formatting or regex replacements may be necessary to do some final touches on the formatted code until we are fully satisfied with the results. After we are satisfied with the code layout we can proceed to the next step.

Recovering function and variable names

While analyzing the code we uncover semantics of functions and variables and should rename them as we advance trough the code. Every new renamed variable/function will speed up further analysis and reduce the time to cover all the code. Names should be concise and have clear meaning associated with them so all subsequent encounters of that variable/function are quickly recognized and can be skipped.
Following is an example of code before and after renaming process.
Obfuscated code:

Renamed code:



Common JavaScript obfuscations

After code has been properly formatted we can see additional obfuscations introduced to the code. Let's now examine common JavaScript obfuscations on this sample.

Hiding use of eval()

One of the most commonly used JavaScript obfuscations is using eval() function to run code stored as a string in a variable. This obfuscator is no different and uses several different eval() obfuscations.
To hide uses of eval() the code will assign function to various randomly named variables in an attempt to disguise eval usage. The following code snippet shows several steps used to hide eval() from static analysis.


This technique of hiding functions is not reserved just for eval() but it is typically used to obfuscate usage of all functions that could be used to statically identify malicious code.
Slightly more advanced example of assigning eval to a variable is use using string transformations to build eval string. One such example is inserting junk characters in between eval letters and then removing them dynamically with regular expressions. With this simple rule it is possible to generate polymorphic eval assignments.


Previous expression will remove all characters from the string except those listed in the regular expression, which is equivalent to the following:
eval2=eval('eval');

Opaque predicates

Opaque predicate is defined as an expression for which outcome is predetermined to be always true or false. Most simple example of this is expression if( true ). Malware authors use opaque predicates to thwart static analysis tools by constructing expressions that are not so simple to determine without evaluating them inside the targeted environment. Dadong JSXX uses mathematical functions to build opaque predicates which are then used as arguments in loops. Let's examine one of the expressions used as opaque predicate:


We can divide the expression into groups and evaluate each of the logical expressions:


Inserting the results into original expression we have:
~(0 | ( 1 | 0 & 0)) = ~( 0 | 1 ) = ~1 = 0

So the previous complicated expression will always evaluate to 0 and can effectively be rewritten as:
fExpression_eq0 = 0;

Chaining multiple opaque predicates in different variables makes it harder to statically determine what actually is an opaque predicate and what is a non-reducible expression.

Self-referencing decryption

One very interesting method against code formatting is using self referencing decryption. Let's examine the following code snippet:


Rewritten for easier understanding:


aCodeAsString, originally named sBtEp6, is referencing itself inside the string that is evaluated so any modification or formatting of the aCodeAsString will result in unsuccessful decryption of the final payload effectively preventing any modifications to the code.

Encrypted code

All the previous obfuscations serve to make the static decryption of the final malicious payload hard. Variable vlWWlBt3 from the original obfuscated snippet contains hex encoded encrypted JavaScript code. As the decryption algorithm has to be contained in the script previous obfuscations make sure that detection and analysis of the algorithms are complicated. Encryption algorithms is XOR based where the decryption key is generated from the self-referencing string so it implement simple type of tamper-proof protection. Decrypted code is then simply evaluated by eval() and executed inside the browser.
Final functionality contains the malicious payload that will launch the Java exploit and install malware on the compromised system.

Summary

JavaScript language with it's loose syntax offers variety of ways for the attackers to generate polymorphic wrappers for the malicious payload which effectively hinders traditional anti-malware signatures. By understanding techniques employed by the malware authors we can provide the best protection to our customers with BlackTitan Internet Security.


84 comments:

  1. Replies
    1. It is because, you would probably divide the shifting process as per the ability of your Near close relatives associates and based on which you would try to share your shifting stress.شهاب مظفری

      Delete
    2. IEEE Final Year projects Project Centers in Chennai are consistently sought after. Final Year Students Projects take a shot at them to improve their aptitudes. IEEE Final Year project centers ground for all fragments of CSE & IT engineers hoping to assemble.Final Year Projects for CSE

      Spring Framework has already made serious inroads as an integrated technology stack for building user-facing applications. Spring Framework Corporate TRaining .

      Specifically, Spring Framework provides various tasks are geared around preparing data for further analysis and visualization. Spring Training in Chennai

      The Angular Training covers a wide range of topics including Angular Directives, Angular Services, and Angular programmability.Angular Training

      Delete
  2. But it is quite sure that it will not be a very huge burden for them to do assistance you in your shifting needs.
    Packers and Movers in Bangalore
    Packers and Movers in Pune
    Packers and Movers in Hyderabad
    Packers and Movers in Mumbai

    ReplyDelete
  3. It is because, you would probably divide the shifting process as per the ability of your Near close relatives associates and based on which you would try to share your shifting stress.

    Packers and Movers in Chennai
    Packers and Movers in Delhi
    Packers and Movers in Gurgaon
    Packers and Movers in Noida

    ReplyDelete
  4. This content is written very well. Your use of formatting when making your points makes your observations very clear and easy to understand. Thank you.
    - usps tracking
    - iphone 7 release date
    - netflix

    ReplyDelete
  5. The article you have shared here very good. This is really interesting information for me. Thanks for sharing!
    hotmail login |hotmail sign in |free hotmail login

    ReplyDelete
  6. I am looking for my memories through the stories, the narrative of people. I feel it is difficult but I will try.
    instagram online viewer

    ReplyDelete
  7. An excellent information provided thanks for all the information i must say great efforts made by you. thanks a lot for all the information you provided.

    potaup

    ReplyDelete
  8. I will make sure to bookmark it and come back to learn extra of your helpful info. Thank you for the post. I will definitely comeback and you can click here for games for to play online.

    ReplyDelete
  9. Nice Blog Post,Kindly Better Imporve blog.Thanks For Sharing.

    ReplyDelete
  10. download app here Download & install the latest version of Taster APK V5.6.1 for Android which is free to use, to start your automation work, get from this official site.

    ReplyDelete
  11. I hope this post of yours will be more appreciated by it really excellent, i enjoyed it, thanks for posting it. I do not feel sorry for taking the time to read this post, it is really nice and useful to me, thanks for posting it.
    abcya3 hot games, friv for school for kids 2019, cá koi mini, io jogos for kids

    ReplyDelete
  12. مقاله و مقاله نویسی یکی از پرکاربردترین و شناخته شده ترین راه ها برای ارائه دانش و دستاوردهای علمی در سطح بین المللی محسوب میشود. از این رو عده ی کثیری از افراد برای ترجمه تخخصی مقالات خود برای نشریات خارجی نیازمند بهره مندی از نیرویی حرفه ای در زمینه ترجمه است. سایت ترجمه آنلاین با کادری مجرب و با سابقه از بهترین مترجمین سطح کشور ترجمه تخصصی فارسی به انگلیسی از مقاله شما را ارائه میکند تا از ترجمه مقالات خود برای ارسال به نشریات خارجی آسوده خاطر باشید.

    ReplyDelete
  13. CANNABIS DISPENSARY GOALS


    We are the most legit cannabis dispensary with both wholesale and retail weed for sale. Marijuana extract and thc cartridges are also available. We deliver in almost all states in the US and Puerto Rico. We are available in Canada, UK, USA, South America, Europe and Australia

    Pills and chemicals Online

    Pain killers

    marijuana extracts

    cartridges

    sativa strains

    spacemonkeymeds for sale

    pre rolls for sale

    indica strains for sale online

    Buy edibles online

    cbd oil online

    Buy vape pens online

    Buy wax online

    Buy dankvapes online

    Buy hybrid strains online

    Buy moonrocks online

    Buy carts with Bitcoin online

    cannabis products for sale

    sour diesel online

    ReplyDelete
  14. طراحی وب سایت تخصصی و حرفه ای متناسب با کسب و کار و شغل شما، بالاترین و حرفه ای ترین خدمات در کوتاه ترین زمان و بالا ترین کیفیت در بازار، وب سایتی در حد طراحی فروشگاه اینترنتی دیجی کالا ،فرصتی استثنایی برای شما که به دنیال بهترین هایید د

    ReplyDelete
  15. เกมยิงปลา เกมส์ดีๆ เกมส์แสนสนุกแห่งยุคนี้
    https://www.slot1234.com/เกมยิงปลาออนไลน์

    ReplyDelete
  16. Delhi Assembly Election 2020: Delhi Assembly Election has been declared in the capital of the nation. The Election Commission held a question and answer session on Monday evening. With this, the set of accepted rules has come into power in the capital. If you don't mind tell that votes will be thrown in every one of the 70 get together seats in Delhi on February 8 and political race results will be declared on February 11. In Delhi, the decision party Aam Aadmi Party indeed faces the Bharatiya Janata Party and the Congress.
    Read more - https://www.dainiktimes.com/

    ReplyDelete
  17. Excellent erudition Providing by your Article, thank you for taking the time to share with us such a nice article. Amazing insight you have on this, it's nice to find a website that details so much information about different artists. Kindly visit the LiveWebTutors website we providing the best online assignment help services in Australia.

    For More Info: Assignment Writing Help

    ReplyDelete
  18. Packers And Movers Bangalore Local Household Shifting Service, Get Free Best Price Quotes Local Packers and Movers in Bangalore List, Compare Charges, Save Money And Time at
    Local Packers And Movers Bangalore

    ReplyDelete
  19. I am receiving a lot of fun, one of the products that makes me most satisfied is you. I was wandering somewhere I couldn't find what I was looking for, I found you with the treasure I was looking for.
    Thank you for sharing
    Friv3 | Friv2020 | Friv4 | gamesgames free games

    ReplyDelete
  20. Online religion research paper writing services are very difficult to complete and many students are always searching for Religion Research Paper Services companies to help them complete their custom religion essay writing services.

    ReplyDelete
  21. Business information systems research paper services have become very popular for students studying business & information technology coursework as they engage the best online Information Systems Writing Services.

    ReplyDelete
  22. I concur with a great deal of the focuses you made in this article. I welcome the work you have placed into this and expectation you keep composing regarding this matter.

    SEO services in kolkata
    Best SEO services in kolkata
    SEO company in kolkata
    Best SEO company in kolkata
    Top SEO company in kolkata
    Top SEO services in kolkata
    SEO services in India
    SEO copmany in India

    ReplyDelete
  23. Hello the truth is excellent content, thank you very much for sharing it. Spider-Man: Far from Home

    ReplyDelete
  24. I should state you are exceptionally gifted at enticing composition on the off chance that you can persuade me to share your perspectives. I am extremely dazzled by your superb composing capacities. It would be ideal if you keep up the great instructive composition.


    Denial management software
    Denials management software
    Hospital denial management software
    Self Pay Medicaid Insurance Discovery
    Uninsured Medicaid Insurance Discovery
    Medical billing Denial Management Software
    Self Pay to Medicaid
    Charity Care Software
    Patient Payment Estimator
    Underpayment Analyzer
    Claim Status

    ReplyDelete
  25. The growth of the Yumberry Market is indicated by a number of product launches in the beverages segment, where manufacturers have developed yumberry drinks and are marketing it as a healthy superfruit drink. This trend is especially followed in the North American region and to some extent in Europe.

    ReplyDelete
  26. https://www.cratoswin.com/

    Canlı bahis sitesi

    Vip casino sitesi Cratosslot

    Egt slot oyunları

    Online canlı bahis sitesi Cratossporting

    Online casino Cratosslot

    En iyi oyunlar 

    Tüm radyo frekansları için

    ReplyDelete
  27. A Chatbot Development is a product program for reproducing wise discussions with human utilizing rules or man-made brainpower. Clients connect with the Chatbot development service by means of conversational interface through composed or spoken content. Chatbots can live in informing stages like Slack, Facebook Messenger bot developer and Telegram and fill some needs – requesting items, thinking about climate and dealing with your fund in addition to other things. As a Chatbot development company advancement organization our competency let you find happiness in the hereafter by taking care of clients all the more intelligently to accomplish wanted outcome. As a Chatbot companies we can streamline a large portion of your dreary undertakings, for example, voice bot advancement and client service, online business advices and so on

    ReplyDelete
  28. I am Irene Garcia, a Corporate Sales Specialist operating in the Latin American region. We are experts in Market Research (Mercado Latinoamericano de Energías Renovables). We provide market reports across various industry verticals and also help with procurement and supply chain intelligence. By giving you better insights, we help you make informed business decisions.

    ReplyDelete
  29. I am Irene Garcia, a Corporate Sales Specialist operating in the Latin American region. We are experts in Market Research (Mercado Lácteo de América Latina). We provide market reports across various industry verticals and also help with procurement and supply chain intelligence. By giving you better insights, we help you make informed business decisions.

    ReplyDelete
  30. I am Irene Garcia, a Corporate Sales Specialist operating in the Latin American region. We are experts in Market Research (Mercado Latinoamericano de Comida a Domicilio Online). We provide market reports across various industry verticals and also help with procurement and supply chain intelligence. By giving you better insights, we help you make informed business decisions.

    ReplyDelete
  31. I am Irene Garcia, a Corporate Sales Specialist operating in the Latin American region. We are experts in Market Research (Mercado Latinoamericano de Energías Renovables). We provide market reports across various industry verticals and also help with procurement and supply chain intelligence. By giving you better insights, we help you make informed business decisions.

    ReplyDelete
  32. Custom psychology research writing services are very difficult to complete and many students are always searching for Developmental Psychology Writing Services to help them complete their psychology assignment writing services and developmental psychology essay writing services.

    ReplyDelete
  33. There are many theology & religion coursework writing services and Religious Research Writing Services to choose from for those stuck with their religion assignment writing services and theology essay writing help services.

    ReplyDelete
  34. Public relations research writing services are very difficult to complete and many students are always searching for Public Relations Writing Services to help them complete their public relations coursework services and public relations research writing services.

    ReplyDelete
  35. นี่เป็นกระทู้ที่ยอดเยี่ยมและมีประโยชน์อย่างมาก ขอบคุณสำหรับข้อมุล. สวัสดี! ฉันเป็นนักพัฒนาเว็บไซต์สำหรับเล่นเกมสล็อต บาคาร่า และเกมอื่นๆ มากกว่า 200 รายการ แทงบอล ในมือถือ เราเปิดให้บริการ 24 ชั่วโมง มีโปรโมชั่นดีๆ มากมาย สำหรับสมาชิกเก่าและสมาชิกใหม่ และแจกเครดิตฟรี หากสมาชิกใหม่.

    ReplyDelete
  36. There are many custom coursework writing services and Business Coursework Writing Services to choose from for those stuck with their custom paper writing services and custom college coursework writing services.

    ReplyDelete
  37. Usually, I never comment on blogs but your article is so convincing that I never stop myself to say something about it. You’re doing a great job Man, Keep it up. We provide the highest quality in mold remediation services, asbestos removal & water dry out in Maricopa County including Phoenix, Mesa, Chandler, Glendale, Scottsdale and Gilbert! for more information visit our website water damage restoration | Water Restoration experts | water cleanup experts phoenix

    ReplyDelete
  38. Such great information for the blogger I am a professional blogger thanks. The La Barbera proudly serves a great combination of modern and traditional barbery. for more information visit our website Barbershop | haircut near me

    ReplyDelete
  39. This programming language is very nice and developers' favourite because they think that it is very easy and attackers can attack on sites due to this language. So, focus on this programming language and get benefits. Dissertation editing services.

    ReplyDelete
  40. Mercado Latinoamericano de la Leche en Polvo| Participación, Tamaño, Precio, Crecimiento, Análisis, Tendencias de la Industria, Informe de Investigación, Perspectivas y Pronóstico 2020-2025
    Mercado Latinoamericano de la Leche en Polvo

    ReplyDelete
  41. Mercado Latinoamericano de Ingredientes Orgánicos para el Cuidado Personal| Participación, Tamaño, Precio, Crecimiento, Análisis, Tendencias de la Industria, Informe de Investigación, Perspectivas y Pronóstico 2020-2025
    Mercado Latinoamericano de Ingredientes Orgánicos para el Cuidado Personal

    ReplyDelete
  42. Mercado Latinoamericano de Trituradoras de Chatarra| Participación, Tamaño, Precio, Crecimiento, Análisis, Tendencias de la Industria, Informe de Investigación, Perspectivas y Pronóstico 2020-2025
    Mercado Latinoamericano de Trituradoras de Chatarra

    ReplyDelete
  43. Mercado Latinoamericano de Cera de Candelilla| Participación, Tamaño, Precio, Crecimiento, Análisis, Tendencias de la Industria, Informe de Investigación, Perspectivas y Pronóstico 2020-2025
    Mercado Latinoamericano de Cera de Candelilla

    ReplyDelete
  44. Get Packers and Movers Jaipur List of Top Reliable, 100% Affordable, Verified and Secured Service Provider. Get Free ###Packers and Movers Jaipur Price Quotation instantly and Save Cost and Time. Packers and Movers Jaipur ✔✔✔Reviews and Compare Charges for household Shifting, Home/Office Relocation, ***Car Transportation, Pet Relocation, Bike SHifting @ Packers And Movers Jaipur

    ReplyDelete
  45. I'm a long-serving digital marketing professional and full-service as a social media marketing manager. I'm offering services at a competitively low cost. I have experience in keyword research, Article writing or Rewriting, Guest posting, B2B Lead Generation , Data Entry ,link building, web 2.0 backlink ,
    . I have 5 years of experience in the field and are assured of delivering High Quality and manual work. I have my own site name as AbidhTech. My Blog site also here. This is a Bangla deshi Science club site .

    ReplyDelete