deobfuscating-javascript-malware

Files (4)

• LICENSE
• SKILL.md
• api-reference.md · references/
• agent.py · scripts/

SKILL.md (first lines)

# Deobfuscating JavaScript Malware

## When to Use

- Investigating a phishing page with obfuscated JavaScript that performs credential harvesting or redirect
- Analyzing a web skimmer (Magecart-style) injected into an e-commerce site
- Deobfuscating a JavaScript dropper that downloads and executes second-stage malware
- Examining malicious email attachments containing HTML files with embedded obfuscated scripts
- Analyzing browser exploit kits that use heavy JavaScript obfuscation to hide exploit delivery

**Do not use** for obfuscated JavaScript that is merely minified production code; use a standard beautifier instead.

## Prerequisites

- Node.js 18+ installed for executing and debugging JavaScript in a controlled environment
- Python 3.8+ with `jsbeautifier` library for code formatting
- Browser developer tools (Chrome DevTools) for controlled execution in an isolated browser
- CyberChef (https://gchq.github.io/CyberChef/) for encoding/decoding operations
- de4js or JStillery for automated JavaScript deobfuscation
- Isolated analysis VM with no access to production systems or sensitive data

## Workflow

### Step 1: Safely Extract and Examine the Obfuscated Script

Isolate the malicious JavaScript without executing it:

```bash
# Extract JavaScript from HTML file
python3 << 'PYEOF'
from html.parser import HTMLParser

class ScriptExtractor(HTMLParser):
    def __init__(self):
        super().__init__()
        self.in_script = False
        self.scripts = []
        self.current = ""

    def handle_starttag(self, tag, attrs):
        if tag == "script":
            self.in_script = True
            self.current = ""

    def handle_endtag(self, tag):
        if tag == "script":
            self.in_script = False
            if self.current.strip():
                self.scripts.append(self.current)

    def handle_data(self, data):
        if self.in_script:
            self.current += data

with open("malicious_page.html") as f:
    parser = ScriptExtractor()
    parser.feed(f.read())

for i, script in enumerate(parser.scripts):
    with open(f"script_{i}.js", "w") as f:
        f.write(script)
    print(f"Extracted script_{i}.js ({len(script)} bytes)")
PYEOF

# Beautify the extracted JavaScript
npx js-beautify script_0.js -o script_0_pretty.js
```

### Step 2: Identify Obfuscation Techniques

Categorize the obfuscation methods used:

```
Common JavaScript Obfuscation Techniques:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
String Encoding:
  - Hex encoding:          "\x68\x65\x6c\x6c\x6f" -> "hello"
  - Unicode escapes:       "\u0068\u0065\u006c\u006c\u006f" -> "hello"
  - Base64:                atob("aGVsbG8=") -> "hello"
  - charCodeAt/fromCharCode: String.fromCharCode(104,101,108,108,111)
  - Array-based lookup:    var _0x1234 = ["hello","world"]; _0x1234[0]

Eval Chains:
  - eval(atob("..."))
  - eval(unescape("..."))
  - new Function("return " + decoded)()
  - document.write("<script>" + decoded + "</script>")
  - setTimeout(decoded, 0)

Control Flow:
  - Switch-case dispatcher with shuffled case order
  - Opaque predicates (always-true/false conditions)
  - Dead code insertion
  - Variable name mangling (_0x4a3b, _0xab12)

Anti-Analysis:
  - Debugger traps: setInterval(function(){debugger;}, 100)
  - Console detection: overriding console.log
  - Timing checks: performance.now() deltas
  - DevTools detection: window.outerWidth - window.innerWidth > 100
```

### Step 3: Remove Anti-Analysis Protections

Neutralize anti-debugging and anti-analysis traps:

```javascript
// Remove debugger traps before analysis
// Replace in the obfuscated script:

// Before:
setInterval(function() { debugger; }, 100);

// After (neutralized):
setInterval(function() { /* debugger removed */ }, 100);

// Neutralize DevTools detection
// Before:
if (window.outerWidth - window.innerWidth > 160) { window.location = "about:blank"; }

From mukul975/Anthropic-Cybersecurity-Skills, Apache-2.0.

More from mukul975/Anthropic-Cybersecurity-Skills