ScanJavascript¶
This scanner extracts various components from JavaScript files, such as tokens, keywords, strings, identifiers, and regular expressions. It also has the option to deobfuscate the JavaScript before scanning. URLs within the script are extracted and added as indicators of compromise (IOCs).
Source code in strelka/src/python/strelka/scanners/scan_javascript.py
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 | |
scan(data, file, options, expire_at)
¶
Scans a Javascript file, tokenizes it, and extracts useful components.
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
data |
Content of the file being scanned. |
required | |
file |
File metadata. |
required | |
options |
Scanner options. |
required | |
expire_at |
Expiry timestamp of the scan task. |
required |
Source code in strelka/src/python/strelka/scanners/scan_javascript.py
process_token(token, max_strings)
¶
Processes each token, categorizing and storing relevant data.
Source code in strelka/src/python/strelka/scanners/scan_javascript.py
extract_urls(text, max_strings)
¶
Extracts URLs from the provided text using regex matching.
Source code in strelka/src/python/strelka/scanners/scan_javascript.py
trim_event_data(max_strings)
¶
Trims the event data to the maximum number of strings specified.
Source code in strelka/src/python/strelka/scanners/scan_javascript.py
Features¶
The features of this scanner are detailed below. These features represent the capabilities and the type of analysis the scanner can perform. This may include support for Indicators of Compromise (IOC), the ability to emit files for further analysis, and the presence of extended documentation for complex analysis techniques.
| Feature | Support |
|---|---|
IOC Support |
|
Emit Files |
|
Extended Docs |
|
Malware Scanner |
|
Image Thumbnails |
Tastes¶
Strelka's file distribution system assigns scanners to files based on 'flavors' and 'tastes'. Flavors describe the type of file, typically determined by MIME types from libmagic, matches from YARA rules, or characteristics of parent files. Tastes are the criteria used within Strelka to determine which scanners are applied to which files, with positive and negative tastes defining files to be included or excluded respectively.
| Source Filetype | Include / Exclude |
|---|---|
javascript_file |
|
text/javascript |
Scanner Fields¶
This section provides a list of fields that are extracted from the files processed by this scanner. These fields include the data elements that the scanner extracts from each file, representing the analytical results produced by the scanner. If the test file is missing or cannot be parsed, this section will not contain any data.
| Field Name | Field Type |
|---|---|
beautified |
bool |
elapsed |
str |
flags |
list |
identifiers |
str |
iocs |
str |
keywords |
str |
regular_expressions |
str |
script_length_bytes |
int |
strings |
str |
suspicious_keywords |
str |
tokens |
str |
urls |
str |
Sample Event¶
Below is a sample event generated by this scanner, demonstrating the kind of output that can be expected when it processes a file. This sample is derived from a mock scan event configured in the scanner's test file. If no test file is available, this section will not display a sample event.
test_scan_event = {
"elapsed": 0.001,
"flags": [],
"tokens": unordered(
[
"LineComment",
"String",
"Identifier",
"Punctuator",
"RegularExpression",
"Numeric",
"BlockComment",
"Keyword",
]
),
"keywords": unordered(
[
"var",
"in",
"this",
"typeof",
"return",
"function",
"if",
"else",
"throw",
"new",
"for",
]
),
"strings": unordered(
[
"",
"ws",
"open",
"string",
"ftp://suspicious-ftp-server.org",
"Checking URL: ",
"Fetching data from: ",
"base64",
"path",
".",
"-",
" (",
"fs",
"utf8",
"package.json",
"https://another-example-bad-site.net",
"Found unknown type of partial ",
"use strict",
") in Handlebars partial Array => ",
"function",
"Could not find partial with name ",
"http://example-malicious-site.com",
"http://example-malicious-site.com/data",
"Connection established",
]
),
"identifiers": unordered(
[
"compile",
"Handlebars",
"send",
"urls",
"partials",
"JSON",
"pkg",
"open",
"eval",
"console",
"params",
"cwd",
"register",
"key",
"replace",
"suspiciousUrl",
"toLowerCase",
"hasOwnProperty",
"WebSocket",
"concat",
"arguments",
"ws",
"partial",
"Buffer",
"helpers",
"btoa",
"dynamicEval",
"opt",
"slugify",
"str",
"jsonStringify",
"process",
"url",
"stringify",
"i",
"fetchDataFromUrl",
"context",
"log",
"SafeString",
"on",
"checkMultipleUrls",
"code",
"helper",
"escape",
"a",
"Utils",
"name",
"atob",
"fs",
"obj",
"join",
"path",
"module",
"forEach",
"length",
"establishWebSocket",
"arr",
"b",
"require",
"readFileSync",
"toString",
"parse",
"exports",
"escapeExpression",
"registerHelper",
]
),
"regular_expressions": unordered(["/ +/g", "/[^\\w ]+/g"]),
"suspicious_keywords": unordered(["WebSocket", "eval"]),
"urls": unordered(
[
"https://another-example-bad-site.net",
"http://example-malicious-site.com",
"ftp://suspicious-ftp-server.org",
"http://example-malicious-site.com/data",
]
),
"beautified": True,
"script_length_bytes": 3127,
"iocs": unordered(
[
{
"ioc": "suspicious-ftp-server.org",
"ioc_type": "domain",
"scanner": "ScanJavascript",
},
{
"ioc": "ftp://suspicious-ftp-server.org",
"ioc_type": "url",
"scanner": "ScanJavascript",
},
{
"ioc": "example-malicious-site.com",
"ioc_type": "domain",
"scanner": "ScanJavascript",
},
{
"ioc": "http://example-malicious-site.com",
"ioc_type": "url",
"scanner": "ScanJavascript",
},
{
"ioc": "http://example-malicious-site.com/data",
"ioc_type": "url",
"scanner": "ScanJavascript",
},
{
"ioc": "another-example-bad-site.net",
"ioc_type": "domain",
"scanner": "ScanJavascript",
},
{
"ioc": "https://another-example-bad-site.net",
"ioc_type": "url",
"scanner": "ScanJavascript",
},
]
),
}