{
  "added_at": "2026-11-04",
  "additional_evidence_urls": [
    "https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/package.json",
    "https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/RELEASE_NOTES.txt",
    "https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/integrations/README.md",
    "https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/integrations/docker/Dockerfile",
    "https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/decoder.c",
    "https://github.com/CapacitorSet/box-js/tree/f4bb9942f73e1b6eede149103fa074e0d408a6a7/emulator",
    "https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/LICENSE",
    "https://www.npmjs.com/package/box-js/v/1.9.29"
  ],
  "category": "web-analysis",
  "description_en": "Node.js utility for studying malicious JavaScript that runs a sample inside an emulated Windows JScript environment, with WScript, ActiveX, filesystem, registry, WMI and HTTP objects emulated and source rewriting that exposes eval calls and conditional-compilation code. Each analysis writes a results folder with the URLs requested and those that led to an executable payload, every code snippet executed (JavaScript, cmd.exe and PowerShell), files written with their types and hashes, and a list of IOCs; by default downloads are answered with simulated 404 errors so that fallback sites are revealed. Batch runs, an optional prepended file of browser-object stubs, a Docker image, a REST API and export to VirusTotal or Cuckoo support triage at scale.",
  "description_zh": "用于研究恶意 JavaScript 的 Node.js 工具：在模拟的 Windows JScript 环境中运行样本，模拟 WScript、ActiveX、文件系统、注册表、WMI 和 HTTP 对象，并通过改写源码暴露 eval 调用和条件编译代码。每次分析都会生成结果文件夹，记录请求过的 URL 及其中导致可执行载荷的 URL、执行过的每段代码（JavaScript、cmd.exe 和 PowerShell 命令）、写入的文件及其类型和哈希，以及 IOC 列表；默认情况下，下载请求会收到模拟的 404 错误，以暴露样本的备用站点。支持批量分析、可选预置的浏览器对象桩代码文件、Docker 镜像、REST API，以及导出到 VirusTotal 或 Cuckoo，便于大规模初筛。",
  "entry_url": "https://awesomerea.org/resources/box-js/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/box-js/",
  "evidence_url": "https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/README.md",
  "group": "tools",
  "id": "box-js",
  "json_url": "https://awesomerea.org/resources/box-js/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/box-js/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/box-js/index.md",
  "name": "box.js",
  "name_zh": "box.js 恶意 JavaScript 分析工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest npm release at review: 1.9.29, published 2026-07-02 alongside the reviewed master commit, which adapts the sandbox to the latest vm2 package; RELEASE_NOTES.txt numbers the same releases 1.19.x. Recent development is by Kirk Sayre through pull requests. Installs with npm install box-js --global; package.json declares Node.js 6 or later and depends on vm2 >=3.9.19, jsdom 16, acorn and escodegen, and the READMEs list REMnux and BlackArch packages and Cuckoo, CAPE and IntelOwl integrations.",
    "Input is the analyst's own sample file or folder of samples; the repository ships no malware samples, only emulator code, a generated Windows process list (emulator/processes.json), source-rewriting patches and a mocha test file. Encoded .jse files must first be decoded with the bundled decoder.c, MrBrownstone's 2000–2005 Script Encoder decoder, compiled with a C compiler; VBScript is not parsed as input.",
    "Samples run inside vm2, with a 10-second default timeout; --dangerous-vm switches to Node's vm module, which the README says can be broken. --download makes real requests to the URLs a sample contacts, so leave it off unless the network is isolated. The README recommends a temporary Docker container for further isolation; integrations/docker/Dockerfile is based on node:8-alpine, and the REST API server needs a user who can start Docker containers.",
    "Emulation is incomplete by design: unsupported ActiveX objects or methods stop the analysis until someone implements them, and samples with environment or date checks may show no behaviour. MIT; decoder.c keeps its author's notice."
  ],
  "requirements_zh": [
    "审阅时 npm 最新版本为 1.9.29，于 2026-07-02 与所审 master 提交同时发布；该提交使沙箱适配最新的 vm2 包。RELEASE_NOTES.txt 将同一批版本编号为 1.19.x。近期开发由 Kirk Sayre 通过拉取请求进行。可用 npm install box-js --global 安装；package.json 声明需要 Node.js 6 或更高版本，依赖 vm2 >=3.9.19、jsdom 16、acorn 和 escodegen；README 列出 REMnux 与 BlackArch 软件包，以及 Cuckoo、CAPE 和 IntelOwl 集成。",
    "输入是分析者自己的样本文件或样本文件夹；仓库不含恶意软件样本，只有模拟器代码、生成的 Windows 进程列表（emulator/processes.json）、源码改写补丁和一个 mocha 测试文件。编码过的 .jse 文件需先用随附的 decoder.c（MrBrownstone 于 2000–2005 年编写的 Script Encoder 解码器，用 C 编译器编译）解码；不支持以 VBScript 作为输入。",
    "样本在 vm2 中运行，默认超时 10 秒；--dangerous-vm 会改用 Node 的 vm 模块，README 称该沙箱可被突破。--download 会向样本访问的 URL 发出真实请求，除非网络已隔离，否则不要启用。README 建议在临时 Docker 容器中运行以进一步隔离；integrations/docker/Dockerfile 基于 node:8-alpine，REST API 服务器要求运行用户能够启动 Docker 容器。",
    "模拟本身并不完整：遇到尚未支持的 ActiveX 对象或方法时，分析会停止，直到有人实现它们；带有环境或日期检查的样本可能不表现出任何行为。MIT 许可；decoder.c 保留其作者的声明。"
  ],
  "targets": [
    "website"
  ],
  "url": "https://github.com/CapacitorSet/box-js",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}