AwesomeREA.org

Tool

malware-jail

Node.js sandbox for semi-automatic analysis of JavaScript malware: it runs a sample in Node's vm module against emulated Windows Script Host and ActiveX objects such as WScript.Shell, MSXML2.XMLHTTP, ADODB.Stream, Scripting.FileSystemObject and WMI, plus a partial browser context with selectable browser profiles. It logs the objects created and methods called, keeps every eval() argument to help deobfuscation, records requested URLs and WMI queries, and saves the files a dropper tries to write so payloads can be examined. When the run ends, the whole sandbox context is dumped to JSON for review.

Requirements & limits

  • There are no releases or tags, and the README says an npm package is not yet available. The reviewed master commit, from 2023-06-16, only edits the README; the last code change, adding newly analyzed malware and ADODB methods, dates from 2019-08-08. Version labels disagree: package.json says 0.18.0, the README 0.19 and jailme.js 0.20.
  • Requires Node.js and npm: package.json declares Node 6 or later, and the README says the tool was developed and tested on Linux with Node.js v6.6.0; current Node releases were not checked. npm install fetches minimist, iconv-lite, entities and sync-request, npm test runs a small tap suite for the WScript emulation, and native_test holds scripts meant to run under Windows cscript for comparison. Emulation covers the WScript and ActiveX features the author saw malware use and only part of the browser context, so a sample may stop early or diverge from real Windows behavior; the logs and dumps are traces for an analyst, not a verdict.
  • Node's vm module is not a security boundary: the README warns that sandbox-aware malware may try to escape and recommends an unprivileged Linux account or a virtualized Windows machine. By default HTTP requests are not sent and receive dummy responses; --down lets the sample contact remote servers and download payloads, while --h404 and --t404 answer every request with HTTP 404 so all remote URLs can be listed. Execution stops after 60 seconds unless -t sets another limit.
  • The malware folder holds real-world samples, most of them downloaded from malwr.com according to the README, with their logs and dumps. Besides scripts and HTML pages it includes two extracted Windows payload files, a .exe under malware/20171004 and a .tmp under malware/20190808, and the README states that the Angler files are not disarmed, so a clone contains live malware.
  • MIT, per the LICENSE file and README. The reviewed sources state no REA use, and this collection did not run the sandbox or any sample.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary · Website

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · HynekPetrak/malware-jail · Revision ec370f1
  2. jailme.js#L10-L40 GitHub · HynekPetrak/malware-jail · Revision ec370f1
  3. jailme.js#L184-L192 GitHub · HynekPetrak/malware-jail · Revision ec370f1
  4. env/wscript.js GitHub · HynekPetrak/malware-jail · Revision ec370f1
  5. env/browser.js GitHub · HynekPetrak/malware-jail · Revision ec370f1
  6. config.json GitHub · HynekPetrak/malware-jail · Revision ec370f1
  7. package.json GitHub · HynekPetrak/malware-jail · Revision ec370f1
  8. test/wscript_test.js GitHub · HynekPetrak/malware-jail · Revision ec370f1
  9. LICENSE GitHub · HynekPetrak/malware-jail · Revision ec370f1

More in Native binaries

All 107 entries in Native binaries