A Node.js sandbox for semi-automatic JavaScript malware analysis, deobfuscation, and payload extraction.
malware-jail is a Node.js-based sandbox tool for semi-automatic analysis of JavaScript malware. It safely executes malicious scripts in emulated environments like WScript and browsers, intercepting actions to deobfuscate code, extract payloads, and log behavior. It helps security researchers understand malware without risking their systems.
Security researchers, malware analysts, and incident responders who need to analyze JavaScript-based threats, particularly those targeting Windows environments or delivered via web browsers.
It provides a lightweight, cross-platform alternative to heavyweight sandboxes, focusing specifically on JavaScript malware with detailed logging and payload extraction capabilities, all within a familiar Node.js environment.
Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements key ActiveX objects like WScript.Shell and MSXML2.XMLHTTP commonly used by malware, with detailed logging of their creation and usage as shown in sample outputs.
Captures and logs all sandboxed actions including eval() calls, file operations, and object creations, providing a full audit trail for behavior analysis, as evidenced by the 'sandbox_dump_after.json' file.
Allows configuring HTTP requests to block, allow, or simulate 404 responses with parameters like '--h404', enabling safe URL enumeration without network interaction.
Runs on any operating system with Node.js >= 6.x, making it usable on Linux, Windows, or macOS without specialized hardware, as stated in the README.
The browser context simulation is only partially implemented, limiting effectiveness for malware relying on full browser environments or newer JavaScript features, as admitted in the README.
The README warns that malware aware of the sandbox might escape, recommending use in unprivileged accounts or virtual machines, indicating it's not a foolproof isolation solution.
No npm package is available yet; installation requires cloning the repository and manually installing dependencies, adding overhead compared to packaged tools.