Deobfuscation Example

This repository demonstrates a practical workflow for analyzing and simplifying a heavily obfuscated JavaScript file extracted from a real-world malware sample.

It documents the process of reducing multiple obfuscation layers through focused transformations, including string recovery, wrapper removal, syntax simplification, and AST-based cleanup. Rather than providing a universal deobfuscation framework, it aims to demonstrate how similar samples can be investigated and analyzed.

Pipeline

The current pipeline consists of the following transformation stages:

1. Normalize hexadecimal numeric expressions.
   • replace_HexNumber.js
2. Format the source code to make later analysis easier.
   • beautify.js
3. Resolve numeric offset tables generated by the obfuscator.
   • replace_offset_table_k.js
   • replace_offset_table_A.js
   • replace_offset_table_M.js
4. Remove generated wrapper functions around decoder logic.
   • unwrap_decoder_wrapper_L.js
   • unwrap_decoder_wrapper_o.js
   • unwrap_decoder_wrapper_I.js
   • unwrap_decoder_wrapper_H.js
5. Recover the string lookup table used by the decoder.
   • resolve_string_table.js
6. Remove unused parameters introduced by the obfuscator.
   • remove_unnecessary_parameters.js
7. Decode obfuscated string values.
   • decode_string_array.js
8. Reconstruct strings split across multiple expressions.
   • combine_chars.js
9. Simplify unusual JavaScript syntax patterns.
   • replace_unorthodox_invocation.js
   • replace_bracket_notation.js
10. Perform AST-based inlining of dispatcher objects and aliases.
    • inline_dispatcher.js
    • inline_alias.js
11. Remove variables and helper objects that are no longer referenced.
    • remove_unused_variables.js
12. Generate the final readable output.
    • beautify_deobfuscated.js

Output

Each transformation produces an intermediate output file:

step1.js
step2.js
step3.js
...
step19.js

The final simplified source is produced after the last transformation step.

Usage

node ./pipeline.js

Workflow

1. Obfuscated JavaScript
2. Source normalization
3. Resolve numeric obfuscation tables
4. Remove decoder wrapper layers
5. Recover hidden strings
6. Simplify JavaScript syntax
7. Perform AST-based cleanup
8. Generate readable JavaScript code

Implementation

The pipeline combines pattern-based rewriting and AST-based transformations to resolve obfuscation patterns, recover hidden values, simplify syntax, and remove generated code structures. Each transformation is kept small and focused, allowing intermediate results to be inspected throughout the analysis process.

Limitations

This repository is not a general-purpose JavaScript deobfuscation framework.

The pipeline was developed around techniques observed in a specific malware sample. While the overall methodology may apply to similar obfuscation schemes, individual transformations may require modification when analyzing different samples.