Forum Discussion

AtakanBal's avatar
AtakanBal
Icon for Bronze III rankBronze III
31 days ago

Reverse Engineering (Offensive) JavaScript Analysis: JSDetox

I'm stuck at below two questions Q6: Which variable does the initial script try to return? Q8: The exploit kit contains a large block of hex encoded shellcode stored in a variable. This shellcode...
help & support
offensive cyber
  • AtakanBal's avatar
    AtakanBal
    27 days ago

    I was able to complete the lab however I think lab needs some improvement

    For Q3, you need to look into the obfuscated code, before applying applying any deobfuscating steps
    For Q8, the data analyze tool in the lab does not work. Use CyberChef or something else, it is very misleading if you assume it works and you are missing something.

    JSDetox error

     

netcat's avatar
netcat
Icon for Bronze II rankBronze II
10 days ago

Oh yeah...just the last question in "Practical Malware Analysis: Static Analysis" is a little bit confusing: "What native Microsoft service is this malware trying to masquerade as with a legitimate seeming name and a reference to a file path that can be used for persistence? (Hint: Review the briefing panel for information on how to override a function signature.)".
"file path"...turns out to be a "file name"