9

Are there signatures for malicious JavaScript codes as they exist for other viruses/worms/trojans developed in other programming languages ?

If so, are these JavaScript malware signatures defined the same way as they are defined in other "standard" malwares ?

I ask this because I need to download some signatures of known JavaScript malwares for a harmless test on my 'anti-malware' like script programmed in Python.

  • Considering that many internet security suits report websites as infected with javascript-based malware, such signatures obviously exist. Why exactly are you asking? – Philipp Apr 22 '14 at 15:33
  • @Philip: I am asking because I want to download some of those signatures and test my small 'anti-virus' program done in Python to make some tests. – user45139 Apr 22 '14 at 15:35
  • So you are not looking for actual signatures of real malware but for a harmless test signature like the EICAR anti-virus test string, but specific for Javascript? You should edit your question to say so. – Philipp Apr 22 '14 at 15:39
  • I edited again my question. How can these signatures look like ? – user45139 Apr 22 '14 at 15:49
6
+100

There are both dynamic and static signatures.

The dynamic signatures are used by dyanmic detection tools such based on analysis of the behaviors of JavaScript malware: whatever the depth and complexity of code obfuscation of a given JS malware the fingerprint and the execution level is the same.

Examples of such tools that rely on fingerprinting the danymic side -execution- of JS malware are:

  1. Iceshield
  2. Zoozle
  3. Spyproxy
  4. EarlyBird
  5. Profiler

Static signatures of JS malware also exist and are used by traditional antiviruses. They either rely on the source code of the malicious JS (the whole of it, or portions of it) or by statistical analysis of some suspicious JS functions such as eval() and unescape().

3

There are signatures, but these don't typically exist in standard AV products. Frequently, these types of protections are found in network based security products such as proxy servers, IPS/IDS, and web application firewalls.

These signatures don't operate on hashes like typical AV signatures do, but rather look at the heuristics or behavior of the code itself. If the scanner looks over a piece of code and it contains a suspicious looking call or function, it can trigger a heuristic detection. This is the only type of functionality that you may find in some consumer level "AV suites" such as Norton's Internet Security or McAfee's Total Protection.

Most enterprise-grade network security products will also be able to perform code analysis on web pages being requested by users. Proxy servers, for example, will analyze the code with the same type of heuristics as mentioned above, but will also do reverse lookups for some code functions. For example, the proxy may actually run a reputation check on a specific IP address that is being called within the JS code.

There is a malware sandboxing technology which is often outside of the budget for anything less than a large enterprise. It is a niche market currently owned by FireEye, Mandiant, and McAfee. These appliances are connected to collection points such as IPS sensors, proxies, email filters, WAF's, etc. and receive copies of data traversing the network boundaries. Once the technology receives the data, it categorizes it and identifies what types code is normal for the type of data (ex. Word doc, PDF, EXE, HTML, etc.) and breaks down the code to identify suspicious code. This part is similar to what the consumer AV does with heuristics. Additionally, malware sandboxing technology will allow the file to execute or run within a virtualized environment to see how it reacts. It will log all network connections, registry changes, file calls, and additional chained executions by which the the appliance makes a determination if the data is safe or not. This same process is performed for many types of data including emails, website requests, file downloads, flash/java applets, and more.

Just how it is in security, there is not one way to identify something as malicious, but rather a lot of comparisons to what is already known to be malicious in order to predict future behavior.

EDIT:

To address your question edit, you'll need to obtain access to some malware repos. These are often accessed via reference while some can be accessed by kind individuals who openly distribute samples found in the wild. Here is a list of repos provided by Lenny Zeltser who is a well-known malware researcher and incident handler for SANS:

http://zeltser.com/combating-malicious-software/malware-sample-sources.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy