deobfuscating-javascript-malware

name	deobfuscating-javascript-malware
description	Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.
domain	cybersecurity
subdomain	malware-analysis
tags	["malware","JavaScript","deobfuscation","web-malware","script-analysis"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Deobfuscating JavaScript Malware

When to Use

• Investigating a phishing page with obfuscated JavaScript that performs credential harvesting or redirect
• Analyzing a web skimmer (Magecart-style) injected into an e-commerce site
• Deobfuscating a JavaScript dropper that downloads and executes second-stage malware
• Examining malicious email attachments containing HTML files with embedded obfuscated scripts
• Analyzing browser exploit kits that use heavy JavaScript obfuscation to hide exploit delivery

Do not use for obfuscated JavaScript that is merely minified production code; use a standard beautifier instead.

Prerequisites

• Node.js 18+ installed for executing and debugging JavaScript in a controlled environment
• Python 3.8+ with jsbeautifier library for code formatting
• Browser developer tools (Chrome DevTools) for controlled execution in an isolated browser
• CyberChef (https://gchq.github.io/CyberChef/) for encoding/decoding operations
• de4js or JStillery for automated JavaScript deobfuscation
• Isolated analysis VM with no access to production systems or sensitive data

Workflow

Step 1: Safely Extract and Examine the Obfuscated Script

Isolate the malicious JavaScript without executing it:

# Extract JavaScript from HTML file
python3 << 'PYEOF'
from html.parser import HTMLParser

class ScriptExtractor(HTMLParser):
    def __init__(self):
        super().__init__()
        self.in_script = False
        self.scripts = []
        self.current = ""

    def handle_starttag(self, tag, attrs):
        if tag == "script":
            self.in_script = True
            self.current = ""

    def handle_endtag(self, tag):
        if tag == "script":
            self.in_script = False
            if self.current.strip():
                self.scripts.append(self.current)

    def handle_data(self, data):
        if self.in_script:
            self.current += data

with open("malicious_page.html") as f:
    parser = ScriptExtractor()
    parser.feed(f.read())

for i, script in enumerate(parser.scripts):
    with open(f, ) as f:
        f.write(script)
    (f)
PYEOF


npx js-beautify script_0.js -o script_0_pretty.js