deobfuscating-javascript-malware

Deobfuscating JavaScript Malware

When to Use

• Investigating a phishing page with obfuscated JavaScript that performs credential harvesting or redirect
• Analyzing a web skimmer (Magecart-style) injected into an e-commerce site
• Deobfuscating a JavaScript dropper that downloads and executes second-stage malware
• Examining malicious email attachments containing HTML files with embedded obfuscated scripts
• Analyzing browser exploit kits that use heavy JavaScript obfuscation to hide exploit delivery

Do not use for obfuscated JavaScript that is merely minified production code; use a standard beautifier instead.

Prerequisites

• Node.js 18+ installed for executing and debugging JavaScript in a controlled environment
• Python 3.8+ with jsbeautifier library for code formatting
• Browser developer tools (Chrome DevTools) for controlled execution in an isolated browser
• CyberChef (https://gchq.github.io/CyberChef/) for encoding/decoding operations
• de4js or JStillery for automated JavaScript deobfuscation
• Isolated analysis VM with no access to production systems or sensitive data

Workflow

Step 1: Safely Extract and Examine the Obfuscated Script

Isolate the malicious JavaScript without executing it:

# Extract JavaScript from HTML file
python3 << 'PYEOF'
from html.parser import HTMLParser

class ScriptExtractor(HTMLParser):
    def __init__(self):
        super().__init__()
        self.in_script = False
        self.scripts = []
        self.current = ""

    def handle_starttag(self, tag, attrs):
        if tag == "script":
            self.in_script = True
            self.current = ""

    def handle_endtag(self, tag):
        if tag == "script":
            self.in_script = False
            if self.current.strip():
                self.scripts.append(self.current)

    def handle_data(self, data):
        if self.in_script:
            self.current += data

with open("malicious_page.html") as f:
    parser = ScriptExtractor()
    parser.feed(f.read())

for i, script in enumerate(parser.scripts):
    with open(f"script_{i}.js", "w") as f:
        f.write(script)
    print(f"Extracted script_{i}.js ({len(script)} bytes)")
PYEOF

# Beautify the extracted JavaScript
npx js-beautify script_0.js -o script_0_pretty.js