0

Recently I was going over my network activity and came upon a PCAP that is directly related to a Trojan Dropper. Taking a quick look into the TCP stream of the packets, I found some malicious Javascript Content. The only problem is... I have no idea how to de-obfuscate it.

Here is what my TPC Stream shows

GET /sugg/suggestajaj.jsp?key=qin&type=web&pr=sohu HTTP/1.1
DNT: 1
Host: w.sugg.sogou.com
Accept: application/javascript, */*;q=0.8
Cookie: CXID=5248838DA4CABE5D9A294184931BF24E; SUID=D0B686402141900A54AE07DE000AB3F1; SUV=1431693802951096; LSTMV=292%2C445; LCLKINT=24499; IPLOC=US
Referer: http://www.sohu.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Language: en-US
Connection: Keep-Alive

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 06 Jul 2016 16:39:39 GMT
Content-Type: application/x-javascript;charset=GBK
Content-Length: 695
Connection: keep-alive
Expires: Wed, 06 Jul 2016 16:39:39 GMT
Cache-Control: max-age=0

sugCls.handleContent("%5Bqin%5D%3B%3B%26%3B%3B%5B%E4%BA%B2%E7%88%B1%E7%9A%84%E7%BF%BB%E8%AF%91%E5%AE%98%3B%3B0%2C+%E7%A7%A6%E6%97%B6%E6%98%8E%E6%9C%88%E4%B9%8B%E5%90%9B%E4%B8%B4%E5%A4%A9%E4%B8%8B%3B%3B0%2C+%E4%BA%B2%E7%88%B1%E7%9A%84%E7%BF%BB%E8%AF%91%E5%AE%98%E7%94%B5%E8%A7%86%E5%89%A7%3B%3B0%2C+%E6%83%85%E4%BE%A3%E5%A4%B4%E5%83%8F%3B%3B0%2C+%E7%A7%A6%E6%97%B6%E6%98%8E%E6%9C%88%3B%3B0%2C+%E4%BA%B2%E7%88%B1%E7%9A%84%E7%BF%BB%E8%AF%91%E5%AE%98%E5%89%A7%E6%83%85%E4%BB%8B%E7%BB%8D%3B%3B0%2C+%E9%9D%92%E4%BA%91%E5%BF%97%3B%3B0%2C+%E9%9D%92%E9%9D%92%E8%8D%89%3B%3B0%2C+%E6%83%85%E8%B0%9C%E7%9D%A1%E7%BE%8E%E4%BA%BA%3B%3B0%2C+%E6%83%85%E4%BE%A3%E7%BD%91%E5%90%8D%3B%3B0%5D%3B%3B%26%3B%3B%5B%5D");

This seems to be related to a Sogou/Sohu Web Hijacker based on my research.

Any help in trying to de-obfuscate this or at least pointing me in the right direction is greatly appreciated!

EDIT

So I did some work and noticed that this JavaScript is set to the charset GBK or Chinese. I tried doing a GBK deobfuscate and translated it in Google. This is the following result

sugCls.handleContent ( "[qin] ;; & ;; [Dear translator;; 0, Qin Shiming month Dominating;; 0, dear translator drama;; 0, 0;; couple picture, qinshiming 0;; dear translator Synopsis;; 0, Aspiration;; 0, 0;; green grass, feeling the mystery of Sleeping Beauty;; 0, couple screen name;; 0];; &;; [] ") ;

This makes no sense whatsoever...

1

The sugCls.handleContent method code is here starting on line 1263: https://github.com/liigo/html-parser/blob/master/test/testfiles/sohu.com.html

You can see that it does some interesting slicing and dicing to extract parts of the string it is passed. To de-obfuscate, one would need to follow each step manually, run the command in its intended context and hook the output (e.g. to a console), or extract the relevant bits of the handleContent method and write an equivalent method.

Unfortunately, the purpose of obfuscation is to make sure that the code will not make sense to a human interpreter. By nature, de-obfuscation is a very difficult process, and there are hundreds of techniques and tools one might apply (often to no avail!).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.