JavaScript Obfuscation - It’s All About the P-a-c-k-e-r-s

Or Katz opens with why obfuscated JavaScript is common in phishing pages, Magecart skimmers, supply chain injections and malware droppers, and why hash- and text-based detection struggles against it. His goals were a method that works on the raw file, runs quickly across very large volumes, and avoids rendering pages. He focused on the most widely used JavaScript packers, on the bet that a small set of them accounts for most obfuscated code in the wild.

The core technique parses scripts into abstract syntax trees and matches the structure of a packer's decoding routine rather than its variable names, which change easily. He built signatures for five packers, four of which share a pattern of splitting or encrypting a payload and decoding it at runtime. He tested them on a large, noisy phishing set, a curated malware set and a benign set drawn from popular sites. Detections on benign sites were reviewed by hand and found to be legitimate obfuscation, often from third-party scripts shared across many domains. To cut false positives, he suppressed hashes seen widely on popular domains, and he trained a simple decision tree on features such as identifier counts and array lengths to separate malicious from benign obfuscated files.

The main takeaway is that obfuscation alone does not mean malicious, so a packer match is a statistical signal that works best combined with reputation and features. Planned next steps include releasing the code, adding more packers, generating signatures automatically and improving the datasets.