New Anti-analysis Technique For Script Malware

[Peaches]

Jun28

New Anti-analysis Technique for Script Malware

1:42 pm (UTC-7) | by Jonathan San Jose (Threats Analyst)

Recently, we came across JS_VIRTOOL which uses certain Javascript techniques so that encrypted code may not be decrypted and analyzed by a malware analyst.

Here is how this is done:

It retrieves the URL where the malicious script is located.

It retrieves its own function and adds the string of the URL.

It computes the CRC of the function plus the URL.

It decrypts an encrypted code in the script body using the CRC that was computed.

It executes the decrypted code using the eval() function.

details trendlabs - http://blog.trendmicro.com/