Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.
Investigating a phishing page with obfuscated JavaScript that performs credential harvesting or redirect
Analyzing a web skimmer (Magecart-style) injected into an e-commerce site
Deobfuscating a JavaScript dropper that downloads and executes second-stage malware
Examining malicious email attachments containing HTML files with embedded obfuscated scripts
Analyzing browser exploit kits that use heavy JavaScript obfuscation to hide exploit delivery
Do not use for obfuscated JavaScript that is merely minified production code; use a standard beautifier instead.
Detection Gaps & Validation
Static decoders miss runtime-built strings. de4js/JStillery resolve obfuscator.io string arrays, but they don't execute code that assembles payloads at runtime (String.fromCharCode loops feeding eval, array rotation computed from page state). When static output still contains eval/Function/atob, you have another layer.
Eval chains hide behind aliases. Malware renames the sinks: window["ev"+"al"], []["constructor"]["constructor"], setTimeout(str), document.write. Hook all of these in a Node vm sandbox that logs-and-returns instead of executing, then re-feed captured output until no sink remains.
Dynamic second stages won't appear offline. Skimmers fetch the real logic from an external URL or a data:/base64 inline image at runtime - confirm by capturing the sandboxed network/fetch/XHR calls, not just the static file.
Neutralize anti-analysis first.debugger traps, DevTools-size detection, and performance.now() timing checks will derail browser stepping - stub them before dynamic runs, or you'll mistake an evasion bail-out for benign code.
Confirm a hit by reaching a concrete IOC: an exfil endpoint, an injected payment-form selector, a redirect target, or decoded shellcode/exploit. Re-run the deobfuscated script in the sandbox to verify the behavior matches.
Benign lookalikes: webpack/Terser minification, ad/analytics/anti-fraud scripts, and licensed packers (JScrambler) look heavily obfuscated but are legitimate - judge on the revealed behavior and destination, not on obfuscation density alone.
Prerequisites
Node.js 18+ installed for executing and debugging JavaScript in a controlled environment
Python 3.8+ with jsbeautifier library for code formatting
Browser developer tools (Chrome DevTools) for controlled execution in an isolated browser
Deobfuscated Malware Categories and IOC Extraction:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Credential Harvester:
- Form action URLs (exfiltration endpoints)
- XMLHttpRequest/fetch destinations
- Targeted input field names (username, password, cc_number)
Web Skimmer (Magecart):
- Payment form overlay injection
- Card data exfiltration URLs
- Keylogger event listeners (onkeypress, oninput)
Redirect Script:
- Destination URLs in location.href assignments
- Conditional redirects based on user-agent or referrer
- Cloaking logic (show benign content to bots)
Exploit Kit Landing:
- Browser/plugin version checks
- Exploit payload URLs
- Shellcode embedded as arrays or encoded strings
Key Concepts
Term
Definition
Eval Chain
Nested layers of eval(), Function(), or document.write() calls that each decode one layer of obfuscation before passing to the next
String Array Rotation
Obfuscation technique storing all strings in a shuffled array and accessing them by computed index to hide string literals
Dead Code Insertion
Adding non-functional code blocks that never execute to increase analysis complexity and confuse pattern matching
Opaque Predicate
Conditional expression whose outcome is predetermined but difficult to determine statically; used to obscure control flow
Anti-Debugging
JavaScript techniques to detect and thwart browser DevTools or debugger usage including debugger statements and timing checks
Web Skimmer
Malicious JavaScript injected into e-commerce sites to steal payment card data from checkout forms (Magecart attack)
Tools & Systems
CyberChef: GCHQ's web-based tool for encoding/decoding transformations useful for unwinding multi-layer obfuscation
de4js: Online JavaScript deobfuscator supporting common obfuscation tools (obfuscator.io, JScrambler)
Node.js VM Module: Sandboxed JavaScript execution environment for safely evaluating obfuscated code with intercepted APIs
Chrome DevTools: Browser developer tools for stepping through JavaScript execution with breakpoints and console access
JSDetox: JavaScript malware analysis tool providing execution emulation and deobfuscation
Common Scenarios
Scenario: Deobfuscating a Magecart Web Skimmer
Context: A compromised e-commerce site has obfuscated JavaScript injected into its checkout page. The script needs deobfuscation to identify the data exfiltration endpoint and determine what customer data was stolen.
Approach:
Extract the injected script from the page source (often appended to a legitimate JS file or loaded from an external domain)
Beautify the code and identify the obfuscation technique (typically string array + rotation + hex encoding)
Decode string encoding layers (hex -> Unicode -> base64) using the Python decoder script
Resolve the string array by evaluating the array definition and rotation function
Identify the form targeting logic (querySelector for payment form fields)
Extract the exfiltration URL from the XMLHttpRequest or fetch call
Document stolen data fields and exfiltration endpoint for incident response
Pitfalls:
Executing obfuscated scripts on a connected system (the script may phone home during analysis)
Not removing anti-debugging traps before using browser DevTools (infinite debugger loops)
Missing additional obfuscation layers loaded dynamically from external URLs
Overlooking base64-encoded inline images or data URIs that may contain additional scripts
