JavaScript Obfuscation: It’s All About the P a c k e r s
summary
Built a static scanner that converts code to AST to JSON and matches structural signatures for five packers, finding 2.1% matches in a 100k phishing corpus and that 26% of malware samples use obfuscation. Uses hash-based reuse detection to whitelist third‑party benign scripts and cuts false positives ~20%. Trains a decision tree on three features (identifiers starting with _0, array element count, unique identifiers) and flags ~75% of 1,500 push/shift-packed malicious samples.
AI-written summary · about
chapters (9)
- 0:00Start
- 7:29Javascript Obfuscation - Introduction
- 9:09Why Javascript is being Obfuscated?
- 16:57Parsing Javascript - Using AST
- 19:21The Story Behind 5 Packers
- 30:00False Positives - Benign Obfuscated Code Javascript Hash Relations (Random and Alexa)
- 32:33True Positives - Machine Learning
- 34:06Push-Shift Packer - Benign vs. Malicious
- 36:12Decision Tree
related talks
23mNext-Generation of Exploit Kit Detection By Building Simulated Obfuscators
45m"Advanced Malware Threat: handling obfuscated code using..."
44mUsing Pester & ScriptAnalyzer for Detecting Obfuscated...
26mAn Effective Approach to Software Obfuscation
35mEnhancing Software Composition Analysis Resilience Against Container Image Obfuscation
26mOne Packer to Rule Them All
52mFlying Under the Radar - New Security Evasion Techniques
13mComparing Malware Evasion Theory with Practice: Results from Interviews with Expert