deobfuscating-javascript-malware

name	deobfuscating-javascript-malware
description	Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation. . Use when working with deobfuscating javascript malware.
domain	cybersecurity
tags	["malware","JavaScript","deobfuscation","web-malware","script-analysis"]
subdomain	malware-analysis
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Deobfuscating Javascript Malware

Overview

Cybersecurity skill for deobfuscating javascript malware. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "deobfuscating javascript malware"

• "Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages"

• Investigating a phishing page with obfuscated JavaScript that performs credential harvesting or redirect

• Analyzing a web skimmer (Magecart-style) injected into an e-commerce site

• Deobfuscating a JavaScript dropper that downloads and executes second-stage malware

• Examining malicious email attachments containing HTML files with embedded obfuscated scripts

• Analyzing browser exploit kits that use heavy JavaScript obfuscation to hide exploit delivery

Do not use for obfuscated JavaScript that is merely minified production code; use a standard beautifier instead.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope
• The target is a legitimate site's request-signing logic, not malware — use js-reverse; this skill is malware-payload-only.

Prerequisites

• Node.js 18+ installed for executing and debugging JavaScript in a controlled environment
• Python 3.8+ with jsbeautifier library for code formatting
• Browser developer tools (Chrome DevTools) for controlled execution in an isolated browser
• CyberChef (https://gchq.github.io/CyberChef/) for encoding/decoding operations
• de4js or JStillery for automated JavaScript deobfuscation
• Isolated analysis VM with no access to production systems or sensitive data

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": ,
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}