Malware Analysis - 3 ways to deobfuscate JScript and JavaScript malware

We use abstract syntax tree manipulation, regex search and replace and dynamic analysis to deobfuscate and unpack GootLoader. Each method has its own pros and cons. GootLoader is an initial infector written in JScript. Current samples feature up to five layers of packed and obfuscated code. Malware Analysis course: extract called functions: helpers gootloader unpacker: sample: Follow me on Twitter: 00:00 Introduction 00:26 First Layer - extract relevant functions 07:24 Regex deobfuscation 14:05 Abstract syntax tree transformations with babel 30:57 Dynamic deobfuscation 40:46 Deobfuscation method overview 41:43 GootLoader unpacker