Due to heavy obfuscation, the script failed to deobfuscate inside some analysis tools and required manual deobfuscation. We were able to deobfuscate its first layer under controlled environment using Internet Explorer developer’s debugging tool. After some debugging of the code, one of the variables held a much better readable script as shown in Figure 2.
Figure 2: Deobfuscating first layer script code using debugging
On further debugging, the script threw an error after deobfuscating its first layer code as shown in Figure 3.
Figure 3: First layer deobfuscated script code
The above script is much more readable but needs to be formatted for better understanding. Here is how the first part of the de-obfuscated script looks like as shown in Figure 4.
Figure 4: Initial part of the formatted first layer deobfuscated script
And the last section of the script contains interesting code as shown in Figure 5.
Figure 5: Last section of the formatted first layer deobfuscated script
The Summary of activities performed by the script are listed below:
As we said above, this script uses the “arguments.callee.toString()” property, which contains the currently executing function and “arguments.callee.caller.toString()” returns caller function code. This is a very well known trick used by attackers in order to prevent modification of the code. So, any changes made inside this script will fail the final deobfuscation. That being said, our manual debugging fails and the script throws an error as shown in Figure 6.
Figure 6: Script throws error since caller function returns null
Since we have formatted and deobfuscated the first layer, property “arguments.callee.caller.caller.toString()” returns null as the caller function is changed. So we will have to debug from the original first layer script code without formatting the code. To understand what those caller function variables contain, we will re-run the first layer script inside the debugger. The debugger stops and throws an error allowing us to see variable values as shown in Figure 7.
Figure 7: Script fails to execute due to arguments.callee() trick
The script failed again due to some changes inside preventing final deobfuscation, but we now know what the script expects and does. Once executed, the script will contact its C&C (command and control) server with a POST request as shown below in Figure 8.
Figure 8. Malicious script communicates with its C&C server