2

Are there any sandbox environments that performs analysis on obfuscated javascript code?

For example, I have a piece of obfuscated JS code that executes perfectly but is impossible to un-obfuscate (tried it on quite a few sites).

I want to know what variables have been read by this and what operations have been performed on the data generated.

Is this possible?

For those of you asking about the code:

<script>var
_0x4c36=['w6rChcKeWsKXw7TCocOlNF8Kw7bCuMKdKsOWTMKjF2A=','V3PClhXDu8OCCMO5WwbCp8KhD8KVw7LDo8KOwr7CiA==','w6saBzVaIwbDk8OqHMKGwpvDgzzCixMTMMOL','w5HClUhaw5TDlQM6GVJMS8KmD8KYXTfCgynCtxU=','w6rDkRl2ehcFDcOVVBpibHlAIG4IKcOq','wr3Co8K0QsOGGsO2WcOHDMKpwoxSVGJKc8OHMBbCgivDnA==','WMKMQXbCpAzCpcOJP0HCkSXCuTQP','ZcOXAsOfw5rChMOGVsOESXEI','w6LDu2h7wrAwFcON','w6Ikw4nClFQZw5RHw5Rvwo/DhcKGacO8','w7V9wrrDrkEaMcOVaWbDv8Ka','w5LDqwtPahEeEsOSUzFy','w7PDkcOBUcK+w7U=','XcKpw7LDgW7DglZ+','RcKzwqc2RcOEH2vDhw==','dsKZw4/DnHvDg0x0wqdPZg==','w6HDhsOqaH7CrMOSw5I=','dMOFw6DCiQ==','F8O8w5o7LmbCsgA=','QcK0w4TDkw==','wpXCg8ODOcKow5DColY=','w7pqwqvDiQ==','w7DDmcOuVsKTw5LDrg==','w5Uvw4vCr8OIVAZLw6zCn0HCuEk=','dWLCjxM=','eMOGwpbDgDPCjFzCs8KubV4geW/Cvg==','wozCuErDo8KlBsODUQc=','w4IoZMK5w5s=','w4lTHA==','w4bCrsKbVsKbw7fCusOqOw==','w6JEwrjCgTvCjRdYIcOjw5hZYSZr','w7jDh8O6VsKFw7nDi8ONw4nCrjE=','wpXCicOOP8Kow5E=','w5PDvBBjXQ0NCcOzSSFy','RQ7CvcO3O2fDhsK6w5fCgg==','w6VDwrrChhXChx1JJcO7','w6ouw4TChk0U','wpbDtMOJw613HDA=','w5PDsUDDohvDlsKE','KMKGZ8KbccON','w6PDjMO7U8Kpw640wq8=','wpbDtMOdw754HTHChg==','wo4NT8KFwowHw5B0wrciwqI=','RWI6Un7DvhxXwptFaw==','w6XDsVdqwqwwDsOH','wopbwpBEQWLCiWbDkCd8','w6Jwwq/DgUEBLg==','D8O8w6ouKGbCswk=','wpAGQ8KEwowmw4N4wqI=','w6rCicKMU8KQw77CusO5L2Uxw63CmMK0GcOfWsKtEWE5wrM=','w5dGbMO4J8Kxw4oAwpjChzgS','wrgQRMKMwpshw5xowr0=','V3PCkhXDtcODFMO5WA7CisKbCsKXw6zDv8Kfwr7CssKFw5U='];(function(_0x2566b1,_0x524125){var
_0x1212d5=function(_0x2b1926){while(--_0x2b1926){_0x2566b1['push'](_0x2566b1['shift']());}};_0x1212d5(++_0x524125);}(_0x4c36,0x15e));var
_0x1060=function(_0x2d8f05,_0x4b81bb){_0x2d8f05=_0x2d8f05-0x0;var _0x4d74cb=_0x4c36[_0x2d8f05];if(_0x1060['ZyRSGR']===undefined){(function(){var
_0x36c6a6=function(){var _0x33748d;try{_0x33748d=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');')();}catch(_0x3e4c21){_0x33748d=window;}return
_0x33748d;};var _0x5c685e=_0x36c6a6();var _0x3e3156='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x5c685e['atob']||(_0x5c685e['atob']=function(_0x1e9e81){var
_0x292610=String(_0x1e9e81)['replace'](/=+$/,'');for(var _0x151bd2=0x0,_0x558098,_0xd7aec1,_0x230f38=0x0,_0x948b6c='';_0xd7aec1=_0x292610['charAt'](_0x230f38++);~_0xd7aec1&&(_0x558098=_0x151bd2%0x4?_0x558098*0x40+_0xd7aec1:_0xd7aec1,_0x151bd2++%0x4)?_0x948b6c+=String['fromCharCode'](0xff&_0x558098>>(-0x2*_0x151bd2&0x6)):0x0){_0xd7aec1=_0x3e3156['indexOf'](_0xd7aec1);}return _0x948b6c;});}());var _0x29929c=function(_0x5dd881,_0x4b81bb){var _0x18d5c9=[],_0x4ce2f1=0x0,_0x333808,_0x432180='',_0x2ab90b='';_0x5dd881=atob(_0x5dd881);for(var
_0x991246=0x0,_0x981158=_0x5dd881['length'];_0x991246<_0x981158;_0x991246++){_0x2ab90b+='%'+('00'+_0x5dd881['charCodeAt'](_0x991246)['toString'](0x10))['slice'](-0x2);}_0x5dd881=decodeURIComponent(_0x2ab90b);for(var
_0x57b080=0x0;_0x57b080<0x100;_0x57b080++){_0x18d5c9[_0x57b080]=_0x57b080;}for(_0x57b080=0x0;_0x57b080<0x100;_0x57b080++){_0x4ce2f1=(_0x4ce2f1+_0x18d5c9[_0x57b080]+_0x4b81bb['charCodeAt'](_0x57b080%_0x4b81bb['length']))%0x100;_0x333808=_0x18d5c9[_0x57b080];_0x18d5c9[_0x57b080]=_0x18d5c9[_0x4ce2f1];_0x18d5c9[_0x4ce2f1]=_0x333808;}_0x57b080=0x0;_0x4ce2f1=0x0;for(var
_0x219af0=0x0;_0x219af0<_0x5dd881['length'];_0x219af0++){_0x57b080=(_0x57b080+0x1)%0x100;_0x4ce2f1=(_0x4ce2f1+_0x18d5c9[_0x57b080])%0x100;_0x333808=_0x18d5c9[_0x57b080];_0x18d5c9[_0x57b080]=_0x18d5c9[_0x4ce2f1];_0x18d5c9[_0x4ce2f1]=_0x333808;_0x432180+=String['fromCharCode'](_0x5dd881['charCodeAt'](_0x219af0)^_0x18d5c9[(_0x18d5c9[_0x57b080]+_0x18d5c9[_0x4ce2f1])%0x100]);}return
_0x432180;};_0x1060['Pjsvdu']=_0x29929c;_0x1060['vLOTlN']={};_0x1060['ZyRSGR']=!![];}var
_0x441e3a=_0x1060['vLOTlN'][_0x2d8f05];if(_0x441e3a===undefined){if(_0x1060['DuRerv']===undefined){_0x1060['DuRerv']=!![];}_0x4d74cb=_0x1060['Pjsvdu'](_0x4d74cb,_0x4b81bb);_0x1060['vLOTlN'][_0x2d8f05]=_0x4d74cb;}else{_0x4d74cb=_0x441e3a;}return
_0x4d74cb;};function enc(_0xf00bfa,_0x38d001){var _0x3bf9f7='';for(var _0x551157=0x0;_0x551157<_0xf00bfa[_0x1060('0x0','N^4o')];_0x551157++){_0x3bf9f7+=String[_0x1060('0x1','#ij$')](_0xf00bfa[_0x1060('0x2','V(s$')](_0x551157)^_0x38d001[_0x1060('0x3','vSXv')](_0x551157%_0x38d001[_0x1060('0x4','s@Ce')]));}return
_0x3bf9f7;}var a=[navigator['userAgent'],new Date(),(navigator[_0x1060('0x5','XHP5')]instanceof PluginArray?navigator[_0x1060('0x6','H#g9')][_0x1060('0x7','YFnJ')]:0x0)[_0x1060('0x8','^G*e')](),navigator[_0x1060('0x9','XHP5')],window[_0x1060('0xa','mPj%')]['toString'](),window[_0x1060('0xb','dvzq')][_0x1060('0xc','Yk&1')](),(_0x1060('0xd','M3FO')in window||'_phantom'in window||_0x1060('0xe','RmJ7')in window)[_0x1060('0xf','#Hws')](),(_0x1060('0x10','mPj%')in window||_0x1060('0x11','6uL5')in window||_0x1060('0x12','4(ga')in window||_0x1060('0x13','mPj%')in window||_0x1060('0x14',']eFZ')in document||'__driver_evaluate'in document||_0x1060('0x15','6uL5')in document||_0x1060('0x16',']eFZ')in document||_0x1060('0x17','hSFx')in document||'__driver_unwrapped'in document||_0x1060('0x18','tUlI')in document||'__selenium_unwrapped'in document||_0x1060('0x19','#ij$')in document||_0x1060('0x1a','&d04')in document||document[_0x1060('0x1b','O91g')][_0x1060('0x1c','#!^O')](_0x1060('0x1d','Yk&1'))!==null||document[_0x1060('0x1e','s@Ce')][_0x1060('0x1f','RmJ7')]('webdriver')!==null||document['documentElement'][_0x1060('0x20','#ij$')](_0x1060('0x21','^G*e'))!==null)[_0x1060('0x22','WiT#')](),(_0x1060('0x23','G]pe')in navigator)['toString'](),(!!window[_0x1060('0x24','WiT#')])[_0x1060('0x25','P!LY')](),window['location'][_0x1060('0x26','pBo%')]['indexOf']('?')===-0x1?'':window[_0x1060('0x27','#Hws')][_0x1060('0x28','WiT#')]['substring'](window[_0x1060('0x29','N^4o')][_0x1060('0x2a','RmJ7')][_0x1060('0x2b','QIdi')]('?')+0x1)];var b=document[_0x1060('0x2c','Nasw')]('script');b[_0x1060('0x2d','5G6)')]=_0x1060('0x2e','0SYn');var c="cmljx14.js?rbmcpgy=";var k="cmljx14";b[_0x1060('0x31','DnJH')]=c+btoa(enc(JSON[_0x1060('0x32','6uL5')](a),k));document[_0x1060('0x33','vSXv')][_0x1060('0x34','QIdi')](b);</script>

The de-obfuscated JavaScript code:

  • Sorts the array at start of the script
  • Decrypt the array of strings at the start
  • Uses the decrypted values to determine browser global values like navigator object and window object
  • Creates a script tag with src depending on the named "a" array of the end
  • Inject it into the HTML DOM
<script>
   var list_of_str=['w6rChcKeWsKXw7TCocOlNF8Kw7bCuMKdKsOWTMKjF2A=','V3PClhXDu8OCCMO5WwbCp8KhD8KVw7LDo8KOwr7CiA==','w6saBzVaIwbDk8OqHMKGwpvDgzzCixMTMMOL','w5HClUhaw5TDlQM6GVJMS8KmD8KYXTfCgynCtxU=','w6rDkRl2ehcFDcOVVBpibHlAIG4IKcOq','wr3Co8K0QsOGGsO2WcOHDMKpwoxSVGJKc8OHMBbCgivDnA==','WMKMQXbCpAzCpcOJP0HCkSXCuTQP','ZcOXAsOfw5rChMOGVsOESXEI','w6LDu2h7wrAwFcON','w6Ikw4nClFQZw5RHw5Rvwo/DhcKGacO8','w7V9wrrDrkEaMcOVaWbDv8Ka','w5LDqwtPahEeEsOSUzFy','w7PDkcOBUcK+w7U=','XcKpw7LDgW7DglZ+','RcKzwqc2RcOEH2vDhw==','dsKZw4/DnHvDg0x0wqdPZg==','w6HDhsOqaH7CrMOSw5I=','dMOFw6DCiQ==','F8O8w5o7LmbCsgA=','QcK0w4TDkw==','wpXCg8ODOcKow5DColY=','w7pqwqvDiQ==','w7DDmcOuVsKTw5LDrg==','w5Uvw4vCr8OIVAZLw6zCn0HCuEk=','dWLCjxM=','eMOGwpbDgDPCjFzCs8KubV4geW/Cvg==','wozCuErDo8KlBsODUQc=','w4IoZMK5w5s=','w4lTHA==','w4bCrsKbVsKbw7fCusOqOw==','w6JEwrjCgTvCjRdYIcOjw5hZYSZr','w7jDh8O6VsKFw7nDi8ONw4nCrjE=','wpXCicOOP8Kow5E=','w5PDvBBjXQ0NCcOzSSFy','RQ7CvcO3O2fDhsK6w5fCgg==','w6VDwrrChhXChx1JJcO7','w6ouw4TChk0U','wpbDtMOJw613HDA=','w5PDsUDDohvDlsKE','KMKGZ8KbccON','w6PDjMO7U8Kpw640wq8=','wpbDtMOdw754HTHChg==','wo4NT8KFwowHw5B0wrciwqI=','RWI6Un7DvhxXwptFaw==','w6XDsVdqwqwwDsOH','wopbwpBEQWLCiWbDkCd8','w6Jwwq/DgUEBLg==','D8O8w6ouKGbCswk=','wpAGQ8KEwowmw4N4wqI=','w6rCicKMU8KQw77CusO5L2Uxw63CmMK0GcOfWsKtEWE5wrM=','w5dGbMO4J8Kxw4oAwpjChzgS','wrgQRMKMwpshw5xowr0=','V3PCkhXDtcODFMO5WA7CisKbCsKXw6zDv8Kfwr7CssKFw5U='];


(function(list,_0x524125){
  var _0x1212d5 = function(_0x2b1926){
    while(--_0x2b1926){
      list['push'](list['shift']());
    }
  };
  _0x1212d5(++_0x524125);
}(list_of_str,0x15e));

 function check_smth( param_one , param_two){

  param_one = param_one-0x0; //converting to number
    var nth_str_in_list = list_of_str[param_one];

   function asd2 (){
            var return_window= function(){
                var _0x33748d;
                try{
                    _0x33748d = Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');')();
                }catch(_0x3e4c21){
                    _0x33748d=window;
                }
                return _0x33748d;
            };
                var _0x5c685e = return_window();

                var _0x3e3156='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+=';
                _0x5c685e['atob'] || (_0x5c685e['atob'] = function(encoded_string){
                    var _0x292610 = String(encoded_string)['replace'](/=+$/,'');
                    for(var _0x151bd2=0x0 , _0x558098 , _0xd7aec1 , _0x230f38=0x0,_0x948b6c='';
                            _0xd7aec1=_0x292610['charAt'](_0x230f38++);
                            ~_0xd7aec1&&(_0x558098=_0x151bd2%0x4?_0x558098*0x40+_0xd7aec1:_0xd7aec1,_0x151bd2++%0x4)?_0x948b6c+=String['fromCharCode'](0xff&_0x558098>>(-0x2*_0x151bd2&0x6)):0x0){
                        _0xd7aec1=_0x3e3156['indexOf'](_0xd7aec1);
                    }
            console.log(_0x948b6c)
                    return _0x948b6c;
                }
        );
    }
    asd2();




  function asd(arg_one,arg_two) {

      var array_of_numbers=[],_0x4ce2f1=0,_0x333808,_0x432180='',string_result_for='';arg_one=atob(arg_one);
      for(let i=0 , max=arg_one['length']; i<max;   i++){
        string_result_for += '%' + ( '00'+arg_one['charCodeAt'](i)['toString'](0x10))['slice'](-2);
      }

     arg_one=decodeURIComponent(string_result_for);
     //console.log(arg_one)

     for(let i=0; i<256 ;i++){
         array_of_numbers[i]=i;
       }

       for(let i=0; i<256; i++){
        _0x4ce2f1= (_0x4ce2f1 + array_of_numbers[i] + arg_two['charCodeAt'] (i % arg_two['length'] ) ) % 256;
        _0x333808= array_of_numbers[i];
        array_of_numbers[i] =array_of_numbers[_0x4ce2f1];
        array_of_numbers[_0x4ce2f1]=_0x333808;
      }

      _0x57b080=0x0;
      _0x4ce2f1=0x0;
      for(let i=0 ; i < arg_one['length']; i++){
        _0x57b080 = (_0x57b080+0x1) % 0x100;
        //console.log(_0x57b080)

        _0x4ce2f1=(_0x4ce2f1+array_of_numbers[_0x57b080])%0x100;

        _0x333808 = array_of_numbers[_0x57b080];
        //console.log(String['fromCharCode'](arg_one['charCodeAt'](i) ^ array_of_numbers[(array_of_numbers[_0x57b080]+array_of_numbers[_0x4ce2f1])%0x100]));

        array_of_numbers[_0x57b080] = array_of_numbers[_0x4ce2f1];
        //console.log(array_of_numbers);

        array_of_numbers[_0x4ce2f1]=_0x333808;
        //console.log(array_of_numbers);

        _0x432180+=String['fromCharCode'](arg_one['charCodeAt'](i) ^ array_of_numbers[(array_of_numbers[_0x57b080]+array_of_numbers[_0x4ce2f1])%0x100]);

      }
    //  console.log(_0x432180)
      return _0x432180;

  }



  check_smth['Pjsvdu']=asd;
  check_smth['vLOTlN']={};
  check_smth['ZyRSGR']=!![];
  check_smth['DuRerv']=!![];

  var _0x441e3a=check_smth['vLOTlN'][param_one];

  if(_0x441e3a===undefined){

    if(check_smth['DuRerv']===undefined){
      check_smth['DuRerv']=!![];
    }

    nth_str_in_list= check_smth['Pjsvdu'](nth_str_in_list,param_two);
    check_smth['vLOTlN'][param_one]=nth_str_in_list;

  }else{

    nth_str_in_list=_0x441e3a;

  }
  return nth_str_in_list;
}


function enc(arg_one_enc,arg_two_enc){
    var enc_return_string='';
    for(let i=0x0; i < arg_one_enc[check_smth('0x0','N^4o')]; i++){
            enc_return_string+=String[check_smth('0x1','#ij$')](arg_one_enc[check_smth('0x2','V(s$')](i)^arg_two_enc[check_smth('0x3','vSXv')](i%arg_two_enc[check_smth('0x4','s@Ce')]));
        }
    return enc_return_string;
}

/** the object where the payload created
* it checks many system/browser related things
* and creates a <script> tag with src="cmljx14.js?rbmcpgy=ODA="
* and injects it into the DOM
*/

  /*  var a=[
    navigator['userAgent'],
    new Date(),
  navigator[check_smth('0x6','H#g9')][check_smth('0x7','YFnJ')],
  [check_smth('0x8','^G*e')](),
    navigator[check_smth('0x9','XHP5')],
    window[check_smth('0xa','mPj%')]['toString'](),
    window[check_smth('0xb','dvzq')][check_smth('0xc','Yk&1')](),
    (check_smth('0xd','M3FO')in window||'_phantom'in window||check_smth('0xe','RmJ7')in window)[check_smth('0xf','#Hws')](),
    (check_smth('0x10','mPj%')in window||check_smth('0x11','6uL5')in window||check_smth('0x12','4(ga')in window||check_smth('0x13','mPj%')in window||check_smth('0x14',']eFZ')in document||'__driver_evaluate'in document||check_smth('0x15','6uL5')in document||check_smth('0x16',']eFZ')in document||check_smth('0x17','hSFx')in document||'__driver_unwrapped'in document||check_smth('0x18','tUlI')in document||'__selenium_unwrapped'in document||check_smth('0x19','#ij$')in document||check_smth('0x1a','&d04')in document||document[check_smth('0x1b','O91g')][check_smth('0x1c','#!^O')](check_smth('0x1d','Yk&1'))!==null||document[check_smth('0x1e','s@Ce')][check_smth('0x1f','RmJ7')]('webdriver')!==null||document['documentElement'][check_smth('0x20','#ij$')](check_smth('0x21','^G*e'))!==null)[check_smth('0x22','WiT#')](),
    (check_smth('0x23','G]pe')in navigator)['toString'](),
    (!!window[check_smth('0x24','WiT#')])[check_smth('0x25','P!LY')](),
    window['location'][check_smth('0x26','pBo%')]['indexOf']('?')===-0x1
  ?''
  :
    window[check_smth('0x27','#Hws')][check_smth('0x28','WiT#')]['substring'](window[check_smth('0x29','N^4o')][check_smth('0x2a','RmJ7')][check_smth('0x2b','QIdi')]('?')+0x1)];
    var b=document[check_smth('0x2c','Nasw')]('script');
    b[check_smth('0x2d','5G6)')]=check_smth('0x2e','0SYn');
    var c="cmljx14.js?rbmcpgy=";
    var k="cmljx14";
    b[check_smth('0x31','DnJH')]=c+btoa(enc(JSON[check_smth('0x32','6uL5')](a),k));
    document[check_smth('0x33','vSXv')][check_smth('0x34','QIdi')](b);
*/
</script>

closed as off-topic by schroeder Sep 20 '18 at 17:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Questions of the form, "is there a product/service that does X?" is off-topic here. As is "please de-obfuscate this random bit of malicious code". – schroeder Sep 20 '18 at 17:59
0

Some times you need to do this things by your self, also is more challenging and fun. On the example below I just take the variable _0x4c36, that is a list, iterate and decode the base64 and disassemble the code (I just paste the first item of the list)

('w6rChcKeWsKXw7TCocOlNF8Kw7bCuMKdKsOWTMKjF2A=', '\xc3\xaa\xc2\x85\xc2\x9eZ\xc2\x97\xc3\xb4\xc2\xa1\xc3\xa54_\n\xc3\xb6\xc2\xb8\xc2\x9d*\xc3\x96L\xc2\xa3\x17`')
00000000: c3                               RET
00000001: aa                               STOSB
00000002: c285c2                           RET 0xc285
00000005: 9e                               SAHF
00000006: 5a                               POP RDX
00000007: c297c3                           RET 0xc397
0000000a: b4c2                             MOV AH, 0xc2
0000000c: a1c3a5345f0ac3b6c2               MOV EAX, [0xc2b6c30a5f34a5c3]
00000015: b8c29d2ac3                       MOV EAX, 0xc32a9dc2
0000001a: 96                               XCHG ESI, EAX
0000001b: 4cc2a317                         RET 0x17a3
0000001f: 60                               DB 0x60

And the python code that does the work

import base64
import distorm3

for i in variable_0x4c36:
    code = base64.b64decode(i)
    print(i, code)
    iterable = distorm3.DecodeGenerator(0, code, distorm3.Decode64Bits)
    for (offset, size, instruction, hexdump) in iterable:
        print("%.8x: %-32s %s" % (offset, hexdump, instruction))

So it looks a bit suspicious that all the buffers be disassemble from my point of view.

Not the answer you're looking for? Browse other questions tagged or ask your own question.