Error: Script execution timed out.

[Nwinternights]

Hi all, I was trying to decode a jse (d7afb22d8c35874bdbb3227a57948b8b) (https://www.reverse.it/sample/dffa67c8f7c807c9ded265b5706eff1e64a2c836f4af0342fb34aa1bed8bce44?environmentId=100) After compiled the decoder I ran box.js and even if I set long timeout I still have the error below: node run.js ../sample/jse/fatturaN0567.js --timeout=10000 --no-echo

Analyzing ../sample/jse/fatturaN0567.js Using detected encoding The file seems to be encoded with ascii. New ActiveXObject: WScript.Shell New ActiveXObject: Scripting.FileSystemObject New ActiveXObject: ADODB.Stream New ActiveXObject: Shell.Application New ActiveXObject: Msxml2.ServerXMLHTTP FSObject[bufferarray] = ;

/boxjs/node_modules/vm2/lib/main.js:213 throw this._internal.Decontextify.value(e); ^ Error: Script execution timed out. at ContextifyScript.Script.runInContext (vm.js:53:29) at VM.run (/home/....../boxjs/node_modules/vm2/lib/main.js:207:72) at Object. (/home/......./boxjs/analyze.js:294:4) at Module._compile (module.js:569:30) at Object.Module._extensions..js (module.js:580:10) at Module.load (module.js:503:32) at tryModuleLoad (module.js:466:12) at Function.Module._load (module.js:458:3) at Function.Module.runMain (module.js:605:10) @CapacitorSet do you have an idea? regards and thanks for the support!!

[CapacitorSet]

Hello,

it seems that box-js is timing out on this sample because it is heavily obfuscated, involving thousands of function calls and property accesses for every line of actual code. The engine relies on vm2 rather than the native vm module for security reasons (see here for a simple exploit that breaks out of vm);vm2` uses ES6 proxies, which have a certain overhead - I suspect the overhead keeps accumulating until it makes the analysis time out.

I tried deobfuscating it by hand, and after a few tricks I got this version, which doesn't time out but also reports a missing feature in WMI emulation (GetObject(winmgmts:!\\.\root\cimv2) not implemented!).

Thanks for the report. It's late now, but tomorrow I'll open an issue regarding the missing WMI feature and better investigate whether this was due to excessive obfuscation by trying it with the native vm module instead.

Best regards.

---

For the sake of it, I briefly tried to analyze the sample anyway. I removed the part that used WMI, replacing it with processList = "", and found that the script makes a request to https://<ip>/S/lafamilia.php?add=stayoutofmyterritory&u=704130568&o=0&v=20&<random>.

Luckily, the distribution site is now down. However, what the script did was:

• verify that the host replied with HTTP 200
• save the payload to disk
• check the first two bytes of the payload to verify that it starts with the MZ magic number
• call cmd /U /Q /C cd /D <drive letter here>: && dir /b/s/x <long list of file extensions> >>%TEMP%\\<long list of file extensions> for each drive
• call cmd \c start <filename here> (which runs the dropped file)
• call cmd /U /Q /C del /Q/F %TEMP%\\*.exe && del /Q/F %TEMP%\\*.gop && del /Q/F %TEMP%\\*.txt && del /Q/F %TEMP%\\*.log && del /Q/F %TEMP%\\*.jse open 0.

[CapacitorSet]

Oh, one more thing - out of curiosity, how did you come across box-js?

[Nwinternights]

Firts of all, thanks for the quick answer and for the analysis. I came across with boxjs because I was looking for an semi-automated tool that helps me to analyze javascripts without spending the whole day to deobfuscate . I usually work with sandboxes(es cuckoo) and other manual tools (for PE ) but I admit that boxjs is is one of the best forensics tool for JS so far. I really hope that this community will grow. If you want I can "spread the word" about boxjs to other communities. let me know. best regards.

[CapacitorSet]

Thanks for the kind feedback! More publicity is always welcome - this project would greatly benefit from more bug reports and collaborators, as well as being "battle-tested".

With c7c5010d696dcd207ad7a5c0232d1b041c69a46f I made vm2 respect the timeout given by the command line, and after trying it with a timeout of two minutes I got it to work successfully. I'm closing this issue for now.

Once again, thanks for the report, which helped find two issues in box-js and two more in other projects (beautify-web/js-beautify#1211 and babel/babili#618).

[kzc]

@CapacitorSet Perhaps you might find this useful:

https://github.com/mishoo/UglifyJS2/pull/2216#issuecomment-313856762

[CapacitorSet]

Thanks for the heads up, very useful!