De-obfuscating malicious Javascript

Considered as the backbone of UI web development, Javascript is primarily used for scripting and front-end programming. Sounds a bit harmless, right? However, javascript can also be exploited as a malicious tool to execute unwanted actions, unbeknownst to the victim. It can be used to download drive-by malware programs, phish the user, or even perform a complete takeover of the victim’s (vulnerable) web browser. Now, let’s get straight to business…

A company worker forwarded an email to me and requested a threat analysis for suspicious activity. The email was supposedly sent in a spear phishing attempt. There was a file attached that grabbed my attention; Project.html

The .html extension indicates a website file

I powered up my Windows 10 virtual machine for further analysis (the reason being Windows has an inbuilt javascript interpreter; CScript. CScript is used for command-line/terminal output, while WScript is used for GUI interpreter output). I downloaded the file on my virtual machine. Then, I renamed the .html to a .txt extension and opened it using a text editor.

Renaming the file

Looks like some js escape encoding

A <script> tag proves this is some javascript code. The unescape() function replaces any escape-encoded sequence with the character it represents. I made a copy of the Project.txt file to avoid tampering with the original code and renamed the copy’s txt extension to .js. Then, I replaced the document.write function with a WScript.echo function. This is similar to the ‘print’ function, but for WScript/CScript. I powered up cmd and used this command:

cscript “Project2 -Copy.js”

Syntax error

At first, it didn’t work. But after clearing some unnecessary tags from the code, I began to see some proper output.

I redirected the output to a file ‘decode.txt’ using this command:

cscript “Project2 -Copy.js” > decode.txt

Saved output to decode.txt

I took a look at this file and discovered the source code of a website.

Sharing link validation, hm..

I scrolled down the code and discovered a bunch of base64-encoded characters.

Nothing important though

Out of curiosity, I fired up the second tool I would use for this analysis; CyberChef (I highly recommend btw). I put in the ‘from base64’ recipe and pasted the base64 input.

CyberChef powering up.. aha

The results proved me right. Just some basic web fonts :P

I scrolled down further in the code to reveal a form-submit field. This may definitely be a phishing page, but what does it steal and where does it submit?

P.S. Watch out for spelling errors like this one (if you want to spot a phishing attack 101)

It captures the email and password fields with a classic submit-btn. I discovered an eval() object at the bottom of the script with some char-encoded characters.

eval()

I copied the eval() object body, and put it in a new file ‘eval.js’. Then, I replaced the eval() function with a WScript.echo function and ran it on cmd.

cscript eval.js

New output

I redirected this new output to a new file; evaldecode.txt and opened the file in a text editor.

Found a weird domain name but it only redirects to an image sharing site

The image sharing site I was redirected to. Nothing too important here

Feeling a lil’ extra, I baked the remaining code in CyberChef’s javascript beautifier to get a good view. Found some JSON syntax, let’s look into that.

Boom. Found some gold.

I found the website URL where this form submits the stolen credentials; [REDACTED].com/success/list.php

The URL displays a plain body, probably to mask its real intent

I tried traversing the path directory and I discovered… the server was vulnerable!

Found an error_log file, a list.txt file and the list.php file

The server was a LiteSpeed web server. A quick look at the list.txt shows some highly sensitive information, that I CANNOT put on here.

The usernames & passwords of the victims of this attack displayed in plain sight!

Now that it’s confirmed to be a phishing site, (and not some malicious BeEF sandbox escape 0-day), I can take a visual look at the site. I renamed the original file back to .html extension and opened it on my VM browser.

The phishing site

I tested the form by inputting some fake details and submitted them. I checked [REDACTED].com/success/list.txt and the fake input was quickly added to the text file just like the other victims.

Fake credential test

Redirects to microsoft.com after it captures form input

Looking at its parent directory [REDACTED].com, the site appears to be hosted on NameCheap with no index page. I tried looking for an email or any information that can be used to identify the webmaster.. but all efforts proved futile.

[REDACTED].com

Even a WHOIS search displayed only public hosting info, as expected

I gathered all the evidence of the threat analysis procedure and gave it to my client, along with the URL of the website and its related info. The client decided to report this site, and it was taken down in less than an hour. Any further sanctions were enforced at the discretion of the hosting company.

That’s how I was able to de-obfuscate some malicious javascript code and trace it back to the attacker’s server, along with the exposed stolen credentials.

Stay safe.

Stay dangerous.

See y’all next time when I remember my password.