# Deobfuscating Malicious Javascript

> Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets:

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-deobfuscating-malicious-javascript`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/deobfuscating-malicious-javascript
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-deobfuscating-malicious-javascript
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Deobfuscating Malicious JavaScript

## When to Use

- You have obfuscated JS (from a phishing page, HTA, `.js` dropper, or scriptlet) and need its real
  behavior.
- You must recover hidden URLs, dropped commands, or a next-stage payload.
- You want to statically unroll common obfuscation rather than run untrusted code.

**Do not use** a real browser or `node` to execute the script for analysis — that runs the
malware. Use a sandboxed interpreter (box-js) or static transformation only.

## Prerequisites

- A safe analysis approach: static decoding, or a JS malware sandbox (box-js) in the lab.
- Familiarity with common obfuscation: string arrays, `String.fromCharCode`, hex/unicode escapes,
  `eval`/`Function` chains, packers.

## Safety & Handling

- Treat the script as live code; never execute it outside an isolated sandbox.
- Defang recovered URLs and store dropped payloads password-protected.

## Workflow

### Step 1: Normalize and de-pack

Pretty-print the source and identify the obfuscation style (array-shuffle, eval-packer, charcode).
Decode static encodings first: hex/unicode escapes and base64 literals.

```bash
python scripts/analyst.py decode dropper.js
```

### Step 2: Unroll string arrays and char-code builds

Reconstruct strings built from arrays/`fromCharCode`/concatenation to reveal API names, URLs, and
commands.

### Step 3: Resolve eval/Function indirection — safely

Replace `eval`/`new Function` with logging (or a sandbox) so the constructed code is captured as
*data*, not executed, then recurse on the recovered layer.

### Step 4: Extract behavior and IOCs

Identify the dropper actions (WScript.Shell, ActiveX, fetch/XHR), recover URLs and dropped paths,
defang, and route payloads onward.

## Validation

- Static encodings (hex/unicode/base64) are fully decoded.
- String-array/charcode constructions are unrolled to readable strings.
- `eval`/`Function` layers are captured as data and recursed, with no untrusted execution.

## Pitfalls

- Running the script to "see what it does" and infecting the analysis host.
- Stopping at one layer when the dropper nests several.
- Missing environment-keyed branches (only acts on certain dates/locales) during static review.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the static JS decoder.
- ECMAScript spec and box-js (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-deobfuscating-malicious-javascript
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.