Malware Analysis - 3 ways to deobfuscate JScript and JavaScript malware

We use abstract syntax tree manipulation, regex search and replace and dynamic analysis to deobfuscate and unpack GootLoader. Each method has its own pros and cons.
GootLoader is an initial infector written in JScript. Current samples feature up to five layers of packed and obfuscated code.

Malware Analysis course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=DA55C06ECB33D9DF6AC5

extract called functions: https://github.com/struppigel/hedgehog-tools/tree/main/ECMAScript%20helpers
gootloader unpacker: https://github.com/struppigel/hedgehog-tools/tree/main/gootloader
sample: https://bazaar.abuse.ch/sample/1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f/

Follow me on Twitter: https://twitter.com/struppigel

00:00 Introduction
00:26 First Layer - extract relevant functions
07:24 Regex deobfuscation
14:05 Abstract syntax tree …

analysis code cons current dynamic dynamic analysis feature gootloader introduction javascript javascript malware jscript malware malware analysis manipulation obfuscated obfuscated code own regex search unpack written