Recently I received a mail concerning an invoice from a company I never worked with. Thus already prepared, I opened the mail attachment on a unix-based system, and the invoice (*.pdf.zip...) contained a js-file (-> legit invoice my ass). Unfortunately my js-knowledge is limited, but I was wondering what the file does exactly. Of course I do not want to execute it (even on my unix system). Thus I was wondering if it is possible to post it here as a question ("What does that script do") for an analysis, without having someone downloading it without the knowledge what to do with it, and thereby damaging his pc?
-
2This has been pretty much asked many times before - and even if the code itself is mildly different each time, the best answers are irrelevant of that. For example - security.stackexchange.com/q/115461/33 (written for PHP, but mostly still applies)...– AviD ModCommented Mar 1, 2016 at 12:42
-
Just because it hasn't been pointed out, I figured I would. If you know it downloads a file, but not sure what the file does, your best option is to execute it on a sandbox computer. It may not give you much information, but I would look up how to create a sandbox computer, then make sure that computer is isolated on the network (to prevent the malicious code from accessing other computers). That way you can basically let it run on that one computer, then you can diagnose it. Otherwise, you would have to see the source code to know what it does.– dakre18Commented Apr 8, 2016 at 16:07
Add a comment
|
1 Answer
If you want an in-depth analysis of the code, you should post to https://reverseengineering.stackexchange.com/
-
I already decoded it myself, and it basically just downloads a file from a server, and executes it... Commented Mar 2, 2016 at 16:08
-