deobfuscating-javascript-malware

Extract the script without executing it, beautify it with js-beautify, then decode string layers using Python scripts or CyberChef. For runtime-built payloads, run the code in a Node.js vm sandbox that hooks eval, document.write, and network calls instead of executing them.

Common tools include CyberChef for encoding transformations, de4js and JStillery for automated deobfuscation of obfuscator.io output, Node.js vm module for sandboxed execution, and Chrome DevTools for stepping through code with breakpoints.

Static decoders cannot resolve strings assembled at runtime, such as String.fromCharCode loops feeding eval or array rotation computed from page state. Skimmers may also fetch second-stage logic from external URLs, which only appears when network calls are captured in a sandbox.

Neutralize debugger statements, DevTools-size detection, and performance.now timing checks before dynamic analysis. Stub these checks or override the functions so the evasion logic does not terminate execution or redirect the analysis session.

Do not use them on merely minified production code such as webpack or Terser output, which only needs a standard beautifier. Judge legitimacy by revealed behavior and network destinations, since licensed packers like JScrambler also look heavily obfuscated.