service_manifest.yml

name: JsJaws
version: $SERVICE_TAG
description: >
  Provides sandboxing for JavaScript.

accepts: code/javascript|code/html|code/hta|code/jscript|code/wsf|code/wsc|image/svg
rejects: empty|metadata/.*

stage: CORE
category: Static Analysis

file_required: true
timeout: 300
disable_cache: false

enabled: true
is_external: false
licence_count: 0

uses_temp_submission_data: true

config:
  # Note that the Docker container must be allowed Internet access as well
  allow_download_from_internet: false
  # Maximum payload files extracted if deep scan is turned off
  max_payloads_extracted: 50
  # Raise a noisy exception if the MalwareJail tool errors, rather than silently letting the other tools output.
  raise_malware_jail_exc: false
  # The limit to number of stdout lines analyzed that were captured from tools
  total_stdout_limit: 10000
  # If you don't want your STDERR clogging up your terminal, set to true
  send_tool_stderr_to_pipe: false
  # The maximum number of times that the gauntlet should be run
  max_gauntlet_runs: 30

submission_params:
  # Service-wide parameters
  - default: 30
    name: tool_timeout
    type: int
    value: 30

  - default: false
    name: add_supplementary
    type: bool
    value: false

  - default: true
    name: static_signatures
    type: bool
    value: true

  - default: true
    name: display_iocs
    type: bool
    value: true

  # Set to "true" if you do not want the file to be executed via Box.js and MalwareJail
  - default: false
    name: static_analysis_only
    type: bool
    value: false

  - default: false
    name: ignore_stdout_limit
    type: bool
    value: false

  # Box.js parameters
  - default: false
    name: no_shell_error
    type: bool
    value: false

  # MalwareJail parameters
  - default: "IE8"
    name: browser
    type: list
    value: "IE8"
    list: [ "IE8", "IE11_W10", "IE7", "iPhone", "Firefox", "Chrome"]

  - default: false
    name: wscript_only
    type: bool
    value: false

  - default: false
    name: throw_http_exc
    type: bool
    value: false

  - default: false
    name: download_payload
    type: bool
    value: false

  - default: false
    name: extract_function_calls
    type: bool
    value: false

  - default: false
    name: extract_eval_calls
    type: bool
    value: false

  - default: false
    name: log_errors
    type: bool
    value: false

  - default: false
    name: override_eval
    type: bool
    value: false

  - default: false
    name: file_always_exists
    type: bool
    value: false

  # Synchrony parameters
  - default: false
    name: enable_synchrony
    type: bool
    value: false

heuristics:
  - heur_id: 1
    name: Network Traffic Detected
    score: 1
    filetype: '.*'
    description: Malware Sandbox Tool(s) detected network traffic.

  - heur_id: 2
    name: IOC(s) Extracted
    score: 1
    filetype: '.*'
    description: At least one IOC has been extracted.

  - heur_id: 3
    name: Suspicious Activity Detected
    score: 1
    filetype: '.*'
    description: Suspicious activity was detected during execution.

  - heur_id: 4
    name: Embedded Code in Common Library
    score: 1000
    filetype: '.*'
    description: Embedded code was discovered in a file posing as a common library. Seen frequently in Gootloader.

  - heur_id: 5
    name: Microsoft Support Diagnostic Tool found in location redirection
    score: 500
    filetype: '.*'
    description: This technique was widely seen as part of the Follina exploit

  - heur_id: 6
    name: Automatic location redirection
    score: 10
    filetype: '.*'
    description: Automatic redirection to another resource

  - heur_id: 7
    name: Suspicious CSS Usage
    score: 10
    filetype: '.*'
    description: Suspicious declarations were detected in HTML stylesheets

  - heur_id: 8
    name: Obfuscated with Obfuscator.io
    score: 1000
    filetype: '.*'
    description: Sample was obfuscated with Obfuscator.io

  - heur_id: 9
    name: ShortCut usage
    score: 100
    filetype: '.*'
    description: Sample uses unusual ShortCut objects

  - heur_id: 10
    name: Long One-Liner
    score: 1
    filetype: '.*'
    description: Sample consists of a long single line of code

  - heur_id: 11
    name: Time Waster
    score: 1000
    filetype: '.*'
    description: Sample uses common time-wasting techniques. Seen frequently in Gootloader.

  - heur_id: 12
    name: Visual Basic and JavaScript
    score: 1
    filetype: '.*'
    description: Sample uses a combination of both Visual Basic and JavaScript

  - heur_id: 13
    name: WScript Shell uses IOCs
    score: 1
    filetype: '.*'
    description: Sample uses a WScript Shell to manipulate network calls

  - heur_id: 14
    name: Single script writes suspicious value
    score: 500
    filetype: 'code/ht.*'
    description: Single script tag with unescaped value written to DOM

  - heur_id: 15
    name: Nested document.write calls
    score: 250
    filetype: '.*'
    description: Multiple rounds of tool runs were required due to nested document.write calls

  - heur_id: 16
    name: Third-party script(s) required
    score: 1
    filetype: '.*'
    description: Reference error caused by requirement of suspicious third party script(s)

  - heur_id: 17
    name: Malformed JavaScript found in visible text
    score: 1
    filetype: '.*'
    description: JavaScript code is found in the visible text of an HTML document, indicating malformation

  - heur_id: 18
    name: Programmatically created script(s) with external source
    score: 1
    filetype: '.*'
    description: Script(s) with an external source were programatically created by the sample.

  - heur_id: 19
    name: Function inception
    score: 500
    filetype: '.*'
    description: Script uses function inception

  - heur_id: 20
    name: Multiple script writes with suspicious values
    score: 500
    filetype: 'code/ht.*'
    description: Multiple script tags with unescaped values written to DOM

  - heur_id: 21
    name: Script contains leading garbage characters
    score: 0
    filetype: '.*'
    description: A script contains leading characters meant to obfuscate / mis-identify the file.

  - heur_id: 22
    name: Detected JavaScript Redirector / Loader
    score: 100
    filetype: '.*'
    description: Low number of body elements.

  - heur_id: 23
    name: document.write usage found in HTML
    score: 100
    filetype: 'code/html'
    description: Suspicious JavaScript code found in HTML file

  - heur_id: 24
    name: HTML document with suspicious title
    score: 100
    filetype: 'code/html'
    description: HTML document has title containing common phishing terms

  - heur_id: 25
    name: HTML document queries sensitive user data
    score: 100
    filetype: 'code/html'
    description: HTML document has password / email / username input fields

  - heur_id: 26
    name: HTML document contains password input but no form action
    score: 100
    filetype: 'code/html'
    description: <input type="password"/> found but no <form action="..."/>

  - heur_id: 27
    name: Suspicious form URL found
    score: 0
    filetype: 'code/html'
    description: Form action is suspicious because form was created in suspicious way

docker_config:
  allow_internet_access: true
  image: ${REGISTRY}cccs/assemblyline-service-jsjaws:$SERVICE_TAG
  cpu_cores: 1
  ram_mb_min: 1536
  ram_mb: 4096