js-deobfuscator

Abstract

With the growth of Web services and the development of web exploit toolkits, web-based malware has increased dramatically. Using Javascript Obfuscation, recent web-based malware hide a malicious URL and the exploit code. Thus, pattern matching for network intrusion detection systems has difficulty of detecting malware. Though various methods have proposed to detect Javascript malware on a users’ web browser, the overall detection is needed to counter advanced attacks such as APTs(Advanced Persistent Treats), aimed at penetration into a certain an organization’s intranet. To overcome the limitation of previous pattern matching for network intrusion detection systems, a novel deobfuscating method to handle obfuscated Javascript is needed. In this paper, we propose a framework for effective hidden malware detection through an automated deobfuscation regardless of advanced obfuscation techniques with overriding JavaScript functions and a separate JavaScript interpreter through to improve jsunpack-n.

1. Related paper

"An Enhanced method for detecting obfuscated Javascript Malware using automated Deobfuscation", Sun-Ho Ji and Huy Kang Kim, Journal of the Korea Institute of Information Security and Cryptology, Volume 22, Issue ,4, 2012, pp.869-882

• • • • • Download

2. Software download

• • • • • https://code.google.com/p/js-deobfuscator/

3. Contact

• • • • • kissmefox at hksecurity.net