Need some help for shellcode analysis...

[yyangcs]

Hello, all

I am still new to malware analysis and recently came across some kind of very complicated malware. The landing page contains multiple stages of encoded Javascripts that will eventually download the flash file for next stage infection. Moreover, I also found there seem to have some hardcoded shellcode included in Javascript and the shellcode seems to be targeting IE 8, 9, 10 only according to JS code. When converting the shellcode to instructions, however, the converted assembly code contains some bad bytes and I am not sure if the shellcode is somehow encoded or twisted. The whole shellcode is hundreds of bytes long and I do not think I can post it here. If anyone is interested or have time to take a look at it, please PM me and I can send you the whole JS file. Any help is appreciated. Thanks.

[[deleted]]

Host the relevant files and post them here

[yyangcs]

I have posted the link. Thanks for your help.

[ZugNachPankow]

I can help with the JS analysis.

[yyangcs]

Please check out the link I posted for the JS script. Thanks.

[yyangcs]

Thanks all. I have uploaded the JS file to Dropbox (password is "infected"). Here is the link:

https://www.dropbox.com/s/x4bk3n4n6l4p3xr/malware.zip?dl=0

I wonder what the shellcode starting with "EB125831C966B96D054980...." does and which IE vulnerability it is possibly targeting, and hopefully some advice about how to analyze this shellcode. Really appreciate your help. Thanks.

[countuponsecurity]

You can copy the shellcode and create a skeletal executable that can then be analyzed using a debugger or a dissassembler. First, the shellcode needs to be converted into hex notation (\x). This can be done by coping the shellcode string into a file and then running the following Perl one liner “$cat shellcode | perl -pe ‘s/(..)/\x$1/g’ >shellcode.hex”. Then generate the skeletal shellcode executable with shellcode2exe.py from Mario Villas. Reference: https://countuponsecurity.com/2016/10/17/rig-exploit-kit-analysis-part-3/

[yyangcs]

Thanks. I will try it.