deobfuscating-javascript-malware

name	deobfuscating-javascript-malware
description	Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control-flow obfuscation to reveal the original malicious logic. Use when investigating a phishing page's obfuscated JavaScript, analyzing a Magecart-style web skimmer, or deobfuscating a JavaScript dropper that fetches second-stage malware.
domain	cybersecurity
subdomain	malware-analysis
tags	["malware","JavaScript","deobfuscation","web-malware","script-analysis"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]
mitre_attack	["T1027","T1027.010","T1140","T1059.007","T1027.006"]

Deobfuscating JavaScript Malware

When to Use

• Investigating a phishing page with obfuscated JavaScript that performs credential harvesting or redirect
• Analyzing a web skimmer (Magecart-style) injected into an e-commerce site
• Deobfuscating a JavaScript dropper that downloads and executes second-stage malware
• Examining malicious email attachments containing HTML files with embedded obfuscated scripts
• Analyzing browser exploit kits that use heavy JavaScript obfuscation to hide exploit delivery

Do not use for obfuscated JavaScript that is merely minified production code; use a standard beautifier instead.

Prerequisites

• Node.js 18+ installed for executing and debugging JavaScript in a controlled environment
• Python 3.8+ with jsbeautifier library for code formatting
• Browser developer tools (Chrome DevTools) for controlled execution in an isolated browser
• CyberChef (https://gchq.github.io/CyberChef/) for encoding/decoding operations
• de4js or JStillery for automated JavaScript deobfuscation
• Isolated analysis VM with no access to production systems or sensitive data

Workflow

Step 1: Safely Extract and Examine the Obfuscated Script

Isolate the malicious JavaScript without executing it:

# Extract JavaScript from HTML file
python3 << 'PYEOF'
from html.parser import HTMLParser

class ScriptExtractor(HTMLParser):
    def __init__(self):
        super().__init__()
        self.in_script = False
        self.scripts = []
        self.current = ""

    def handle_starttag(self, tag, attrs):
        if tag == "script":
            self.in_script = True
            self.current = ""

    def handle_endtag(self, tag):
        if tag == "script":
            self.in_script = False
            if self.current.strip():
                self.scripts.append(self.current)

    def handle_data(self, data):
        if self.in_script:
            self.current += data

with open("malicious_page.html") as f:
    parser = ScriptExtractor()
    parser.feed(f.read())

for i, script in enumerate(parser.scripts):
    with open(f, ) as f:
        f.write(script)
    (f)
PYEOF


npx js-beautify script_0.js -o script_0_pretty.js