Deobfuscating JavaScript Malware

Question

Recently I was going over my network activity and came upon a PCAP that is directly related to a Trojan Dropper. Taking a quick look into the TCP stream of the packets, I found some malicious Javascript Content. The only problem is... I have no idea how to de-obfuscate it.

Here is what my TPC Stream shows

GET /sugg/suggestajaj.jsp?key=qin&type=web&pr=sohu HTTP/1.1
DNT: 1
Host: w.sugg.sogou.com
Accept: application/javascript, */*;q=0.8
Cookie: CXID=5248838DA4CABE5D9A294184931BF24E; SUID=D0B686402141900A54AE07DE000AB3F1; SUV=1431693802951096; LSTMV=292%2C445; LCLKINT=24499; IPLOC=US
Referer: http://www.sohu.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Language: en-US
Connection: Keep-Alive

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 06 Jul 2016 16:39:39 GMT
Content-Type: application/x-javascript;charset=GBK
Content-Length: 695
Connection: keep-alive
Expires: Wed, 06 Jul 2016 16:39:39 GMT
Cache-Control: max-age=0

sugCls.handleContent("%5Bqin%5D%3B%3B%26%3B%3B%5B%E4%BA%B2%E7%88%B1%E7%9A%84%E7%BF%BB%E8%AF%91%E5%AE%98%3B%3B0%2C+%E7%A7%A6%E6%97%B6%E6%98%8E%E6%9C%88%E4%B9%8B%E5%90%9B%E4%B8%B4%E5%A4%A9%E4%B8%8B%3B%3B0%2C+%E4%BA%B2%E7%88%B1%E7%9A%84%E7%BF%BB%E8%AF%91%E5%AE%98%E7%94%B5%E8%A7%86%E5%89%A7%3B%3B0%2C+%E6%83%85%E4%BE%A3%E5%A4%B4%E5%83%8F%3B%3B0%2C+%E7%A7%A6%E6%97%B6%E6%98%8E%E6%9C%88%3B%3B0%2C+%E4%BA%B2%E7%88%B1%E7%9A%84%E7%BF%BB%E8%AF%91%E5%AE%98%E5%89%A7%E6%83%85%E4%BB%8B%E7%BB%8D%3B%3B0%2C+%E9%9D%92%E4%BA%91%E5%BF%97%3B%3B0%2C+%E9%9D%92%E9%9D%92%E8%8D%89%3B%3B0%2C+%E6%83%85%E8%B0%9C%E7%9D%A1%E7%BE%8E%E4%BA%BA%3B%3B0%2C+%E6%83%85%E4%BE%A3%E7%BD%91%E5%90%8D%3B%3B0%5D%3B%3B%26%3B%3B%5B%5D");

This seems to be related to a Sogou/Sohu Web Hijacker based on my research.

Any help in trying to de-obfuscate this or at least pointing me in the right direction is greatly appreciated!

EDIT

So I did some work and noticed that this JavaScript is set to the charset GBK or Chinese. I tried doing a GBK deobfuscate and translated it in Google. This is the following result

sugCls.handleContent ( "[qin] ;; & ;; [Dear translator;; 0, Qin Shiming month Dominating;; 0, dear translator drama;; 0, 0;; couple picture, qinshiming 0;; dear translator Synopsis;; 0, Aspiration;; 0, 0;; green grass, feeling the mystery of Sleeping Beauty;; 0, couple screen name;; 0];; &;; [] ") ;

This makes no sense whatsoever...

Answer 1

The sugCls.handleContent method code is here starting on line 1263: https://github.com/liigo/html-parser/blob/master/test/testfiles/sohu.com.html

You can see that it does some interesting slicing and dicing to extract parts of the string it is passed. To de-obfuscate, one would need to follow each step manually, run the command in its intended context and hook the output (e.g. to a console), or extract the relevant bits of the handleContent method and write an equivalent method.

Unfortunately, the purpose of obfuscation is to make sure that the code will not make sense to a human interpreter. By nature, de-obfuscation is a very difficult process, and there are hundreds of techniques and tools one might apply (often to no avail!).