<commit_before># malware-jail
Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

malware-jail is written for [Node's 'vm' sandbox](https://nodejs.org/api/vm.html). Currently implements 
WScript (Windows Scripting Host) context [env/wscript.js](https://github.com/HynekPetrak/malware-jail/blob/master/env/wscript.js), at least the part frequently used
by malware. Internet browser context is partialy implemented [env/browser.js](https://github.com/HynekPetrak/malware-jail/blob/master/env/browser.js).

Runs on any operating system. Developed and tested on Linux, Node.js v6.6.0.

Due to use of some ES6 features, you'll need Node.js >= 6.x.

> See [EXAMPLES](EXAMPLES.md) for malware samples analyzed.

> If you have new malware samples, please submit them to [javascript-malware-collection](https://github.com/HynekPetrak/javascript-malware-collection), either via issue or pull request.

## New features ##

### Version 0.16 ###

Urls are now saved to urls.json. See latest [EXAMPLES](EXAMPLES.md).

Various bug fixes and improvments.

### Version 0.14 ###

Various bug fixes and improvments.

### Version 0.13 ###

Added new parameters:

    -t msecs - limits execution time by "msecs" miliseconds, by default 60 seconds.
    --h404 - http requests always return HTTP/404. This enables enumerating of all remote URLs.

## Installing ##

You'll need [Node.js](https://nodejs.org) and [npm](https://npmjs.org/) installed.

malware-jail is built on top of [minimist](https://www.npmjs.com/package/minimist), [iconv-lite](https://github.com/ashtuchkin/iconv-lite) 
and [entities](https://www.npmjs.com/package/entities).

### Pull from GitHub ###

Pull the source with git:

    git clone https://github.com/HynekPetrak/malware-jail.git
    cd malware-jail

Then install all the dependecies (minimist, entities, iconv-lite) with:

    npm install<commit_msg>Link corected<commit_after># malware-jail
Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

malware-jail is written for [Node's 'vm' sandbox](https://nodejs.org/api/vm.html). Currently implements 
WScript (Windows Scripting Host) context [env/wscript.js](https://github.com/HynekPetrak/malware-jail/blob/master/env/wscript.js), at least the part frequently used
by malware. Internet browser context is partialy implemented [env/browser.js](https://github.com/HynekPetrak/malware-jail/blob/master/env/browser.js).

Runs on any operating system. Developed and tested on Linux, Node.js v6.6.0.

Due to use of some ES6 features, you'll need Node.js >= 6.x.

> See [EXAMPLES](EXAMPLES.md) for malware samples analyzed.

> If you have new malware samples, please submit them to [javascript-malware-collection](https://github.com/HynekPetrak/javascript-malware-collection), either via issue or pull request.

## New features ##

### Version 0.16 ###

Urls are now saved to urls.json. See latest [EXAMPLES#malware-of-issue-14](https://github.com/HynekPetrak/malware-jail/blob/master/EXAMPLES.md#malware-of-issue-14).

Various bug fixes and improvments.

### Version 0.14 ###

Various bug fixes and improvments.

### Version 0.13 ###

Added new parameters:

    -t msecs - limits execution time by "msecs" miliseconds, by default 60 seconds.
    --h404 - http requests always return HTTP/404. This enables enumerating of all remote URLs.

## Installing ##

You'll need [Node.js](https://nodejs.org) and [npm](https://npmjs.org/) installed.

malware-jail is built on top of [minimist](https://www.npmjs.com/package/minimist), [iconv-lite](https://github.com/ashtuchkin/iconv-lite) 
and [entities](https://www.npmjs.com/package/entities).

### Pull from GitHub ###

Pull the source with git:

    git clone https://github.com/HynekPetrak/malware-jail.git
    cd malware-jail

Then install all the dependecies (minimist, entities, iconv-lite) with:

    npm install
{'fraction_non_alphanumeric': 0.12385786802030457, 'fraction_numerical': 0.012182741116751269, 'mean_word_length': 4.28993288590604, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 9, 'https://': 21, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '431067', 'n_tokens_mistral': 1337, 'n_tokens_neox': 1245, 'n_words': 374}