deobfuscating-malicious-javascript

Name: deobfuscating-malicious-javascript
Author: meltedinhex

18stars5forks

How to install deobfuscating-malicious-javascript?

meltedinhex/analyst-ai-pack/deobfuscating-malicious-javascript

$npx -y skills add meltedinhex/analyst-ai-pack --skill deobfuscating-malicious-javascript

Installs into the current project.

Summary

Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets:

Files · 1

View on GitHub

SKILL.md

1	# Deobfuscating Malicious JavaScript
2
3	## When to Use
4
5	- You have obfuscated JS (from a phishing page, HTA, `.js` dropper, or scriptlet) and need its real
6	behavior.
7	- You must recover hidden URLs, dropped commands, or a next-stage payload.
8	- You want to statically unroll common obfuscation rather than run untrusted code.
9
10	Do not use a real browser or `node` to execute the script for analysis — that runs the
11	malware. Use a sandboxed interpreter (box-js) or static transformation only.
12
13	## Prerequisites
14
15	- A safe analysis approach: static decoding, or a JS malware sandbox (box-js) in the lab.
16	- Familiarity with common obfuscation: string arrays, `String.fromCharCode`, hex/unicode escapes,
17	`eval`/`Function` chains, packers.
18
19	## Safety & Handling
20
21	- Treat the script as live code; never execute it outside an isolated sandbox.
22	- Defang recovered URLs and store dropped payloads password-protected.
23
24	## Workflow
25
26	### Step 1: Normalize and de-pack
27
28	Pretty-print the source and identify the obfuscation style (array-shuffle, eval-packer, charcode).
29	Decode static encodings first: hex/unicode escapes and base64 literals.
30
31	```bash
32	python scripts/analyst.py decode dropper.js
33	```
34
35	### Step 2: Unroll string arrays and char-code builds
36
37	Reconstruct strings built from arrays/`fromCharCode`/concatenation to reveal API names, URLs, and
38	commands.
39
40	### Step 3: Resolve eval/Function indirection — safely
41
42	Replace `eval`/`new Function` with logging (or a sandbox) so the constructed code is captured as
43	data, not executed, then recurse on the recovered layer.
44
45	### Step 4: Extract behavior and IOCs
46
47	Identify the dropper actions (WScript.Shell, ActiveX, fetch/XHR), recover URLs and dropped paths,
48	defang, and route payloads onward.
49
50	## Validation
51
52	- Static encodings (hex/unicode/base64) are fully decoded.
53	- String-array/charcode constructions are unrolled to readable strings.
54	- `eval`/`Function` layers are captured as data and recursed, with no untrusted execution.
55
56	## Pitfalls
57
58	- Running the script to "see what it does" and infecting the analysis host.
59	- Stopping at one layer when the dropper nests several.
60	- Missing environment-keyed branches (only acts on certain dates/locales) during static review.
61
62	## References
63
64	- See [`references/api-reference.md`](references/api-reference.md) for the static JS decoder.
65	- ECMAScript spec and box-js (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

deobfuscating-malicious-javascript

18stars5forks

View on GitHub

How to install deobfuscating-malicious-javascript?

meltedinhex/analyst-ai-pack/deobfuscating-malicious-javascript

$npx -y skills add meltedinhex/analyst-ai-pack --skill deobfuscating-malicious-javascript

Installs into the current project.

Summary

Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets:

Files · 1

View on GitHub

SKILL.md

1	# Deobfuscating Malicious JavaScript
2
3	## When to Use
4
5	- You have obfuscated JS (from a phishing page, HTA, `.js` dropper, or scriptlet) and need its real
6	behavior.
7	- You must recover hidden URLs, dropped commands, or a next-stage payload.
8	- You want to statically unroll common obfuscation rather than run untrusted code.
9
10	Do not use a real browser or `node` to execute the script for analysis — that runs the
11	malware. Use a sandboxed interpreter (box-js) or static transformation only.
12
13	## Prerequisites
14
15	- A safe analysis approach: static decoding, or a JS malware sandbox (box-js) in the lab.
16	- Familiarity with common obfuscation: string arrays, `String.fromCharCode`, hex/unicode escapes,
17	`eval`/`Function` chains, packers.
18
19	## Safety & Handling
20
21	- Treat the script as live code; never execute it outside an isolated sandbox.
22	- Defang recovered URLs and store dropped payloads password-protected.
23
24	## Workflow
25
26	### Step 1: Normalize and de-pack
27
28	Pretty-print the source and identify the obfuscation style (array-shuffle, eval-packer, charcode).
29	Decode static encodings first: hex/unicode escapes and base64 literals.
30
31	```bash
32	python scripts/analyst.py decode dropper.js
33	```
34
35	### Step 2: Unroll string arrays and char-code builds
36
37	Reconstruct strings built from arrays/`fromCharCode`/concatenation to reveal API names, URLs, and
38	commands.
39
40	### Step 3: Resolve eval/Function indirection — safely
41
42	Replace `eval`/`new Function` with logging (or a sandbox) so the constructed code is captured as
43	data, not executed, then recurse on the recovered layer.
44
45	### Step 4: Extract behavior and IOCs
46
47	Identify the dropper actions (WScript.Shell, ActiveX, fetch/XHR), recover URLs and dropped paths,
48	defang, and route payloads onward.
49
50	## Validation
51
52	- Static encodings (hex/unicode/base64) are fully decoded.
53	- String-array/charcode constructions are unrolled to readable strings.
54	- `eval`/`Function` layers are captured as data and recursed, with no untrusted execution.
55
56	## Pitfalls
57
58	- Running the script to "see what it does" and infecting the analysis host.
59	- Stopping at one layer when the dropper nests several.
60	- Missing environment-keyed branches (only acts on certain dates/locales) during static review.
61
62	## References
63
64	- See [`references/api-reference.md`](references/api-reference.md) for the static JS decoder.
65	- ECMAScript spec and box-js (linked in frontmatter).

People who liked this also viewed

6 picks

Type