{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/jailme.js#L10-L40",
    "https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/jailme.js#L184-L192",
    "https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/env/wscript.js",
    "https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/env/browser.js",
    "https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/config.json",
    "https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/package.json",
    "https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/test/wscript_test.js",
    "https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/LICENSE"
  ],
  "category": "dynamic-analysis",
  "description_en": "Node.js sandbox for semi-automatic analysis of JavaScript malware: it runs a sample in Node's vm module against emulated Windows Script Host and ActiveX objects such as WScript.Shell, MSXML2.XMLHTTP, ADODB.Stream, Scripting.FileSystemObject and WMI, plus a partial browser context with selectable browser profiles. It logs the objects created and methods called, keeps every eval() argument to help deobfuscation, records requested URLs and WMI queries, and saves the files a dropper tries to write so payloads can be examined. When the run ends, the whole sandbox context is dumped to JSON for review.",
  "description_zh": "用于半自动分析 JavaScript 恶意代码的 Node.js 沙箱：在 Node 的 vm 模块中运行样本，并模拟 Windows Script Host 与 ActiveX 对象，例如 WScript.Shell、MSXML2.XMLHTTP、ADODB.Stream、Scripting.FileSystemObject 和 WMI，另有可选择浏览器配置的部分浏览器环境。它记录创建的对象和调用的方法，保留每次 eval() 的参数以辅助去混淆，记下请求的 URL 和 WMI 查询，并保存投放器试图写入的文件，便于检查载荷。运行结束时，整个沙箱上下文会导出为 JSON 供复查。",
  "entry_url": "https://awesomerea.org/resources/malware-jail/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/malware-jail/",
  "evidence_url": "https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/README.md",
  "group": "tools",
  "id": "malware-jail",
  "json_url": "https://awesomerea.org/resources/malware-jail/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/malware-jail/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/malware-jail/index.md",
  "name": "malware-jail",
  "name_zh": "malware-jail JavaScript 恶意代码沙箱",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "There are no releases or tags, and the README says an npm package is not yet available. The reviewed master commit, from 2023-06-16, only edits the README; the last code change, adding newly analyzed malware and ADODB methods, dates from 2019-08-08. Version labels disagree: package.json says 0.18.0, the README 0.19 and jailme.js 0.20.",
    "Requires Node.js and npm: package.json declares Node 6 or later, and the README says the tool was developed and tested on Linux with Node.js v6.6.0. npm install fetches minimist, iconv-lite, entities and sync-request, npm test runs a small tap suite for the WScript emulation, and native_test holds scripts meant to run under Windows cscript for comparison. Emulation covers the WScript and ActiveX features the author saw malware use and only part of the browser context, so a sample may stop early or diverge from real Windows behavior; the logs and dumps are traces for an analyst, not a verdict.",
    "Node's vm module is not a security boundary: the README warns that sandbox-aware malware may try to escape and recommends an unprivileged Linux account or a virtualized Windows machine. By default HTTP requests are not sent and receive dummy responses; --down lets the sample contact remote servers and download payloads, while --h404 and --t404 answer every request with HTTP 404 so all remote URLs can be listed. Execution stops after 60 seconds unless -t sets another limit.",
    "The malware folder holds real-world samples, most of them downloaded from malwr.com according to the README, with their logs and dumps. Besides scripts and HTML pages it includes two extracted Windows payload files, a .exe under malware/20171004 and a .tmp under malware/20190808, and the README states that the Angler files are not disarmed, so a clone contains live malware.",
    "MIT, per the LICENSE file and README."
  ],
  "requirements_zh": [
    "没有发布版本或标签，README 称 npm 包尚未提供。所审阅的 master 提交日期为 2023-06-16，只修改了 README；最后一次代码改动在 2019-08-08，新增了已分析的恶意样本和若干 ADODB 方法。各处版本号并不一致：package.json 为 0.18.0，README 为 0.19，jailme.js 为 0.20。",
    "需要 Node.js 和 npm：package.json 声明需 Node 6 或更高版本，README 称该工具在 Linux 上以 Node.js v6.6.0 开发和测试。npm install 会获取 minimist、iconv-lite、entities 和 sync-request，npm test 运行针对 WScript 模拟的小型 tap 测试，native_test 目录中的脚本则用于在 Windows 的 cscript 下运行以作对照。模拟范围限于作者见到恶意代码使用的 WScript 与 ActiveX 功能，浏览器环境也只实现了一部分，因此样本可能提前中止，或与真实 Windows 上的行为不同；日志和导出内容是供分析人员解读的执行记录，而非判定结论。",
    "Node 的 vm 模块并非安全边界：README 警告，能识别该沙箱的恶意代码可能尝试逃逸，建议在无特权的 Linux 账户或虚拟化的 Windows 机器中运行。默认情况下不会真正发送 HTTP 请求，而是返回虚拟响应；--down 允许样本联系远程服务器并下载载荷，--h404 与 --t404 则对所有请求返回 HTTP 404，以便列出全部远程 URL。除非用 -t 另设时限，执行 60 秒后即被终止。",
    "malware 目录收录了真实的恶意样本，README 称多数下载自 malwr.com，并附有对应的日志和导出文件。除脚本和 HTML 页面外，其中还有两个提取出的 Windows 载荷文件，即 malware/20171004 下的一个 .exe 和 malware/20190808 下的一个 .tmp；README 还说明 Angler 相关文件未经解除威胁处理，因此克隆仓库即会获得活体恶意代码。",
    "依据 LICENSE 文件与 README，采用 MIT 许可。"
  ],
  "targets": [
    "binary",
    "website"
  ],
  "url": "https://github.com/HynekPetrak/malware-jail",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}