Zbigniew Tenerowicz lighting talk

### Overview In this lightning talk, the presenter demonstrates an experimental, interactive malware analysis tool designed for JavaScript. The project functions as a tiny lab environment that analyzes heavily obfuscated and compiled JavaScript malware at runtime without granting it actual access to sensitive system resources or requiring manual static deobfuscation.

### Key Topics - Interactive Runtime Emulation: Intercepting and controlling malware execution step-by-step. - Obfuscation and Bytecode Handling: Evaluating multi-layered obfuscated code and V8 bytecode payloads. - Safe Environment Mocking: Providing fake file systems, environment variables, and execution primitives to trace malicious behaviors. - Underlying Technology: Repurposing runtime defense mechanisms from LavaMoat for dynamic analysis.

### Technical Details During the live demonstration, the speaker runs a sample of JavaScript code that has been obfuscated four times. Rather than statically unpacking the sample, the analysis tool steps through execution and prompts the analyst at each stage. When the sample evaluates each layer of obfuscation, the analyst approves the step. When the malware requests critical system APIs—such as requiring the file system (`fs`) or execution functions (`exec`)—the tool denies direct access and instead substitutes emulated or mock implementations.

Specifically, the speaker feeds the malware a mock `process.env` containing a recognizable `LOCALAPPDATA` path string. The malware immediately exposes its intent by attempting to read files from that directory, revealing it as Windows-targeted malware. By tracing its execution, the tool exposes the malware's workflow: iterating through files, inspecting the system task list, and attempting to exfiltrate data by posting it to a Discord webhook. All of this intelligence is captured without allowing file system access, network access, or performing traditional deobfuscation.

Furthermore, the speaker showcases that the tool can analyze compiled sources. Using a JavaScript file compiled to V8 bytecode as a payload delivery mechanism, the tool runs the bytecode with a minor adjustment. As execution proceeds, it logs console output, reveals compiler artifacts dependent on the Node.js version, intercepts `readFileSync` attempts, supplies a fake payload, and observes the payload being passed into `eval` alongside JSON processing.

### Takeaways The tool is an experimental prototype built using components from LavaMoat, an open-source project aimed at protecting JavaScript applications in Node.js and browser environments against runtime supply chain malware. The talk highlights how runtime sandboxing and virtualization primitives used to defend production applications can be inverted into effective, interactive dynamic analysis environments.