The Anti-virus Times

Wednesday, October 17, 2018

What are scripts and what makes them special? Let's compare the contents of a binary file and that of a script.

On the left, you can see what's inside the Windows Explorer's file, and on the right, the contents of a randomly selected script downloaded by our browser when a webpage was loading. The difference is quite obvious. A binary file can be launched right away—it contains machine code that only your computer's CPU will understand. Under normal circumstances, no other software is required to run an executable. But a script is different. It can’t execute itself. Another application has to do that for it.

A script is akin to the scripts used for films or plays.

    ACT I
    SCENE 1
        Elsinore. A platform before the castle.
    Francisco at his post. Enter to him Bernardo.
                    Bernardo
    Who's there?
                    Francisco
    Nay, answer me. Stand and unfold yourself.
    

A script is just text. A director and actors turn it into action.

Computer scripts are no different. They define actions that must be performed. To accomplish this, an interpreter—a program that executes scripts—is required.

This is interesting. Here we’ve provided a somewhat simplified definition of a script. Some scripts are actually compiled. A myriad of other script formats exist too. It’s funny that it really is simpler to open a file to see whether or not it contains text. Using another program to do this is much more difficult!

Why are scripts dangerous?

It is not the malicious impact they can have that presents the biggest problem. Encryption ransomware species can be implemented as binaries as well as scripts. But binary files are "tightly packed", and their contents is structured in a certain way. That's why signatures enable anti-viruses to identify them easily and with a high degree of accuracy.

Making even small alterations to a binary file's contents (e.g., adding a couple of whitespace characters to the code) may render the file non-operational. Meanwhile, malicious scripts can't be crippled so easily.

Source

Does this code possess any peculiar feature that we can use to generate a signature? Well, it's just a piece of code that doesn't appear to be particularly frightening.

A malicious script may contain no malicious code whatsoever. For example, encryption ransomware may rely entirely on the features of an operating system that already incorporates all the programs necessary to accomplish the malicious task—one just needs to run them.

Therefore, malicious scripts are dangerous because:

Why do cybercriminals like scripts?

In addition to the aforementioned advantages, another factor stands in favour of scripts: a script can be run on a variety of platforms, which is not possible for binary files. Scripts only describe what needs to be done.

Do any dangerous script-based malware species exist?

There are more than enough of those. Here is a recent example from Doctor Web's news posts:

Today's most common malicious species are script-based!

This is interesting. You don’t run across viruses, malicious programs that infect other files, among scripts. But Trojans and worms – you see lots of those. For example, JS.Faceworm.1 is a JavaScript-based worm spreading via Facebook. Trojan.Encoder.4860 is an encryption ransomware script, which is also known as JS.Crypt. All its code is written in the JScript language.

#scriptHeuristic #Trojan #security #script #Dr.Web_technologies #malware