In this post I will demonstrate a process for decoding and demystifying a simple darkgate loader vbs script. This script employs minimal obfuscation and is not particularly complex however it does deploy some decoy tactics which can be tricky to navigate and may throw off an inexperienced analyst.
This post will demonstrate some basic techniques for removing decoy code and identifying the final intended functionality of a malicious .vbs script.
The sample hash is
3a586493131b5a1784e7da751f12fd992bc41f300a28dcc5021d2127d33cb8bc and can be found on Malware Bazaar.
I have first downloaded the file and unzipped it using the password
Initial analysis with detect-it-easy shows that it is a plaintext file, so we can largely continue analysis with a text editor. I will be using notepad++.
An initial review of the strings shows some comments suggesting that the file is related to a legitimate windows driver script.
This is used to throw off an inexperienced analyst who may (in a rush) assume that the script is legitimate.
Reviewing a Malware Script Inside a Text Editor
Since the file is in plaintext, I can proceed by opening the file in a text editor. This will allow me to investigate further and determine if the script is legitimate or contains some kind of malicious functionality.
The file initially looks something like this. Note how there is no text highlighting as the initial file did not have a file extension.
I always try to add text highlighting as it can significantly improve the readability of the script being analyzed.
I use the dropdown menu to enable
visual basic highlighting.
It can be a slight art to know which language to choose for text highlighting. In this case i know to use visual basic because of the use of
'at the start of each of the initial lines. This is the visual basic method of declaring a comment.
After looking at a few scripts you’ll get a feel for which language is which, usually based on comment styles and the ways that variables are created. You an also just guess, incorrect highlighting is often better than no highlighting.
After enabling text highlighting, the script now looks significantly better. We can clearly see which lines are comments and which lines contain code.
The initial piece of the script file contains a bunch of comments, these don’t add to functionality at all and can be later removed. They are essentially a decoy used to throw off strings analysis.
Scrolling down, we can also see a bunch of variable creations. These also contain junk strings that don’t add to functionality.
Scrolling down more, we can see a small blob of code that contains a url and appears to be slightly obfuscated.
This is the main piece of code that we are interested in.
Cleaning up The script
Before analysing the “malicious” section, I will go ahead and clean up the rest of the script. This makes it easier to view the malicious section and can reveal other smaller malicious parts that may have been missed.
To do this, I will perform two actions.
- Remove the junk comments
- Remove the junk variables.
To remove the junk comments, I will use a simple regex and the replace function of notepad++ (CTRL+H).
Cleaning Up Malware Scripts Using Regex
Let’s break down that regex. The aim is to completely remove any line that starts with a
^– only look at the start of each line
'– look for a
'at the start of each line
.*– grab everything that comes after the
rn– grab any newlines at the end of each line that we remove.
After hitting enter, the script has been reduced to
143 lines instead of
191. The initial part of the script now looks like this.
Not perfect, but much better.
Now we want to remove the
const variables, which largely appear to be junk.
To do this, we can add another regex. We can essentially re-use the same regex, swapping out the
' for a
const. This will completely remove any line that starts with
After hitting enter,
87 lines are removed from the code.
There are a few empty lines that don’t add any value to the code. You can go ahead and remove these manually or with a regex.
34 lines left. and the script is significantly more readable than before.
Now it’s relatively intuitive to see that a command is executed which calls out to the url and downloads a file.
However, I will instead show some ways of cleaning up the file even further.
Manually Editing A Script To Improve Readability
The first, is to rename variables like this to something more meaningful.
In this case, I have renamed
I won’t go into details about renaming every single variable. It largely doesn’t matter what you pick, as long as the new variable names provides some kind of meaning to you.
Here is an example where I have renamed the remaining values.
It’s now easy to see the script contains the following “True” functionality.
- Creates a web request object
- Performs some junk to display or not display a message box
- Creates a shell application object (used to launch commands)
- Makes a web request to a url
ShellExecuteto execute the response from the web request. (indicating the result is most likely another script)
Now at this point, you could go ahead and perform some manual cleaning up. This would leave you with something like this.
At this point you could go ahead and analyse the malicious domain or go hunting for indications of successful execution in your environment. These indicators could be the domain/url, or potentially the command being executed by the
cmd at the end.
At this point, the script is cleaned up and significantly easier to read. We have removed basic forms of obfuscation used to throw off analysis, and have reduced the script from
191 lines down to only
Although this obfuscation was very basic, hopefully you’ve learnt a new technique or two for analysing script malware.
If you found this useful, consider signing up for the site. Signing up will provide you with access to a discord server, bonus content and early access to future posts.