Pith. sign in

REVIEW 3 major objections 4 minor 69 references

Bypassing Array Canaries via Autonomous Function Call Resolution

T0 review · 3 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that Darcula, a phishing-as-a-service framework, protects its JavaScript payloads with Array Canaries that infinite-loop if altered, and that its new static method AFCR, implemented as Arphsy, resolves the canaried calls…

desk verdict A genuine first look at Darcula's Array Canary with a plausible but unproven bypass; needs an evaluation before the strong claims can stand. read the letter →

arxiv 2501.13256 v1 pith:KNVGYJR6 submitted 2025-01-22 cs.CR

Nathaniel Oh , Paul Attie , Anas Obeidat This is my paper · ORCID
classification cs.CR
keywords ArrayCanaryDarculaJavaScriptdeobfuscationPhishing-as-a-ServiceAutonomousFunctionCallResolutionAbstractSyntaxTreeEmotetshufflinganti-analysisbypass
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper reports a new anti-analysis technique, the Array Canary, in the in-the-wild JavaScript payloads of the Darcula phishing-as-a-service framework. A canary is a string embedded in a shuffled array: if any canary value is changed, an immediately invoked function expression (IIFE) that performs parseInt-based arithmetic never reaches its target constant and the whole program loops forever. The paper argues that this is an advanced form of the array-shuffling obfuscation used by Emotet's downloader, and that it can be bypassed without ever modifying a canary by statically reconstructing the deobfuscation routine. Its proposed Autonomous Function Call Resolution (AFCR), implemented as Arphsy, extracts the relevant functions, locates the entry point via the most reassigned variable, computes the hex range of canary addresses from the largest string array, and runs a harness that resolves all calls. If correct, defenders can strip the canaries from Darcula payloads and feed the recovered strings to an LLM or a human analyst.

What carries the argument

The load-bearing mechanism is the pairing of two heuristics: the 'most reassigned variable' identifies the function that drives the canary shuffle, and the two-offset range (first hex offset plus largest string array length) delimits which hex addresses belong to canary resolution. These heuristics let the harness reuse the file's own functions to resolve calls, a living-off-the-land approach that avoids touching canary values. Arphsy is an Abstract Syntax Tree (AST) parser and aggregator that implements this pipeline: find IIFEs, filter functions to those with no imported calls, find the most reassigned variable, compute the offset range, aggregate functions into a harness, and append driver code.

What would settle it

Take a canaried Darcula sample, run Arphsy, and compare the hex values in the harness's resolved range against the array indices actually consulted by the IIFE's parseInt checks; if any required index lies outside the computed range, the bypass fails. A second test: create a synthetic canaried file in which the most reassigned variable is a decoy unrelated to the shuffle; if Arphsy still resolves the file correctly, the heuristic is not load-bearing, and if it fails, the assumption is confirmed.

Watch

Extended reading notes

Core claim

We observed that Darcula embeds Array Canaries inside the shuffled string arrays of its JavaScript. Each canary value participates in a parseInt-based arithmetic check that must equal a fixed constant; if any canary is modified, the IIFE shifts the array forever and the payload never deobfuscates. AFCR bypasses this by leaving the canaries untouched: it extracts all immediately invoked function expressions (IIFEs), keeps only functions that call internal definitions, identifies the most reassigned variable as the entry point to the deobfuscation routine, takes the first hex offset from that function, and adds the length of the largest string array to bound the range of hex values to resolve. Arphsy builds a harness that invokes the entry function on each hex in that range, yielding the resolved strings. The method is demonstrated on the observed Darcula variants, with the caveat that it fails when the target function is overridden or files exceed 1,000 lines.

Load-bearing premise

The method assumes that the most reassigned variable in a canaried file always holds the deobfuscation entry point, and that the length of the largest string array added to the first hex offset exactly bounds the range of canary addresses to resolve; if a Darcula variant changes either, the harness computes wrong offsets and the bypass stops working.

Editorial extensions

If this is right

  • If AFCR is correct, any observed canaried Darcula payload can be reduced to a harness that resolves every obfuscated string call, enabling further manual or LLM-based analysis without tripping the infinite-loop lock.
  • Existing machine-learning deobfuscators that analyze whole files would hit the canary lock; AFCR offers a pre-processing step that removes the canary before analysis.
  • Because Darcula's Array Canaries are an advanced form of Emotet's array shuffling, the same approach may be back-ported to less sophisticated array-based JavaScript obfuscation.
  • The method is knowingly variant-specific: changing static hooks such as the target function override or RegEx patterns would defeat the current Arphsy implementation, motivating AST-centric generalization.
  • For files over 1,000 lines the current implementation does not fully deobfuscate, so scaling and caching are identified as necessary next steps.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves AFCR's generality unquantified: a natural test is to run Arphsy across all observed Darcula samples and across synthetic canaried files with multiple large arrays, measuring what fraction of resolved strings match the original.
  • If the most-reassigned-variable heuristic is specific to Darcula's obfuscator, a future variant could shuffle two arrays equally often and break the entry-point guess; a more robust version might identify the entry function by its while-true-parseInt structure instead of assignment counts.
  • The reported LLM failures suggest a division of labor that the paper does not explore: deterministic AFCR for resolution, then LLMs for semantic interpretation of the recovered strings.
  • The paper's framing implies that whole-file machine-learning detectors trained on canaried samples may learn 'canary-avoidance' rather than true malicious behavior; de-canarying first could improve both detection and interpretability.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This paper reports the observation of an "Array Canary" anti-analysis mechanism in JavaScript used by the Darcula Phishing-as-a-Service framework: a string array is shuffled by an IIFE whose parseInt-based check must equal a specific constant, and modifying the array values causes an infinite loop. The authors propose Autonomous Function Call Resolution (AFCR), implemented in a proof-of-concept tool called Arphsy, which extracts IIFEs, filters functions by whether they call only locally defined functions, selects the "most reassigned variable" as the decoder entry point, computes a hex offset range from the first offset and the largest string array, and appends driver code to resolve calls by invoking the target file's own functions. The paper claims that this approach bypasses Array Canaries and can guide LLMs and security researchers in deobfuscating canaried JavaScript code, and it points to a public GitHub repository containing the code and sample artifacts.

Significance. The observation of a canary-style infinite-loop lock in Darcula is potentially useful to the phishing defense community, and the living-off-the-land idea of using the obfuscated code's own functions to resolve strings is a sensible way to avoid tripping the lock. The paper ships concrete implementation sketches, lists real deployment artifacts, and opens a public repository, which are strengths. However, the contribution as stated ("bypasses Array Canaries") is not backed by any empirical evaluation in the manuscript; the key methodological assumptions are unvalidated, and the authors themselves enumerate conditions under which the approach fails. As written, the result is best read as a technique description with a proof-of-concept, not as a demonstrated general bypass.

major comments (3)
  1. [Section 4; Tables 1-2] The central claim that Arphsy bypasses Array Canaries is not supported by any reported evaluation. The manuscript lists many Darcula artifacts in Tables 1 and 2 but does not report a single Arphsy run on any of them, no success/failure counts, no comparison between resolved output and ground truth (e.g., strings obtained by executing the file with the canary intact or by manual analysis), and no error analysis. Section 4 additionally concedes that files over 1,000 lines were not fully deobfuscated, that overriding the target function breaks the hex-offset search, and that RegEx hooks are fragile to future Darcula variants. An evaluation on the listed samples, with per-family and per-file outcomes, is necessary before the abstract's "bypass Array Canaries" claim can be accepted.
  2. [Sections 3.4 and 3.5] The two central heuristics are unverified and under-specified. The algorithm assumes that the most reassigned variable is the entry point to the deobfuscation routine and that the largest string array's length plus the first hex offset bounds the canaried address range. The paper gives no correctness argument for either assumption and no evidence that they hold across the Darcula variants in Tables 1-2. In fact, the code in Section 3.4 counts identifier occurrences as initializers or right-hand sides of assignment expressions, which is not the same as counting reassignments; this could select a busy local variable unrelated to the decoder. A wrong selection silently produces an incorrect address window and invalid resolved strings, so the claimed general bypass does not follow from the described implementation.
  3. [Section 3.5; Figure 5] The offset-range calculation has an off-by-one ambiguity. If the largest string array has n entries and the first offset is the starting hex value, the valid canary indices are from that offset through offset + n - 1; the paper states that the second value is "the length of the largest string array added to the first offset found," which would make the range include one extra value. The driver code should define the exact lower and upper bounds used for the loop and justify why the extra iteration is intentional or harmless.
minor comments (4)
  1. [Section 3.3 and 3.4] Typos appear in the prose and code: "FunctionDeclaratoin" in Section 3.3 and "findMostReassignedVariabe" in Section 3.4.
  2. [Throughout] All code listings are referenced as "Listing ??" without actual listing numbers, making it difficult to connect the prose to the code examples.
  3. [Section 2.1] "Phishing-as-a-Serivce" is misspelled, and the sentence "If none of the Array Canaries or modified" is grammatically incomplete.
  4. [Section 4] The anecdotes about LLM prompting failures are interesting motivation, but they are presented without a controlled comparison or any systematic measurement; they should be framed as a design rationale rather than as evidence of LLM inadequacy.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the deobfuscated strings are produced by executing the target's own decoder, not by fitting parameters to a known result or by citing the authors' prior work.

full rationale

The paper's derivation chain does not reduce to its own inputs. AFCR extracts IIFEs, filters functions that only reference file-defined identifiers, locates the most-reassigned variable, computes a hex range from the largest string array plus the first offset, and builds a harness that calls the target file's own decoder function. The resolved strings are outputs of that executed decoder; they are not ground-truth values used to fit the method, and no equation in the paper is definitionally equivalent to another. The heuristics in Sections 3.4 and 3.5 are reverse-engineered from observed Darcula samples, and Section 4 honestly admits that overridden target functions, files over 1,000 lines, and changed RegEx hooks defeat the current implementation. That is a correctness and generality limitation, not circular reasoning. The paper contains no load-bearing self-citations: citations to Netcraft, DONAPI, and BazarLoader provide external context, and no uniqueness theorem or prior work by these authors is invoked to force a choice. Because the central claim depends on unverified variant-specific heuristics, a score of 1 reflects the mild closeness of the heuristic tuning, but there is no identifiable circular step.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several empirical heuristics about the structure of Darcula's canaried files, none of which are proven or benchmarked: the identity of the entry-point function, the role of the largest string array, and the correctness of AST-based dependency filtering. No numeric free parameters are fitted, and no new physical or conceptual entities are introduced beyond the naming of the observed Array Canary pattern.

assumptions (5)
  • ad hoc to paper The most reassigned variable in a canaried file holds the deobfuscation entry-point and the initial hex offset.
    Used throughout Section 3.4-3.5; no evidence that this holds beyond observed samples.
  • ad hoc to paper The largest string array is the canaried array, and its length defines the upper bound of the offset range.
    Section 3.5 'Harness Development'; depends on the specific array layout of Darcula files.
  • domain assumption AST filtering in Section 3.3, which keeps only functions referencing locally defined names, preserves all functions needed for deobfuscation.
    The filter might drop functions that use globals or imported calls; the paper does not test this.
  • domain assumption An unmodified Array Canary loop will terminate because the parseInt expression eventually equals the target constant.
    Section 2.3; observed in the deployed samples, not proven; the paper itself cites the Halting Problem.
  • domain assumption Acorn and Node.js parse and execute the obfuscated code faithfully, with no hidden side effects during parsing.
    All steps in Section 3 assume standard JavaScript semantics and a reliable parser; no verification is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Bypassing Array Canaries via Autonomous Function Call Resolution." pith.science (2026). https://pith.science/paper/KNVGYJR6

@misc{pith2026250113256,
  author       = {Pith},
  title        = {Pith review of: Bypassing Array Canaries via Autonomous Function Call Resolution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KNVGYJR6}},
  note         = {Machine review of arXiv:2501.13256}
}
read the original abstract

We observed the Array Canary, a novel JavaScript anti-analysis technique currently exploited in-the-wild by the Phishing-as-a-Service framework Darcula. The Array Canary appears to be an advanced form of the array shuffling techniques employed by the Emotet JavaScript downloader. In practice, a series of Array Canaries are set within a string array and if modified will cause the program to endlessly loop. In this paper, we demonstrate how an Array Canary works and discuss Autonomous Function Call Resolution (AFCR), which is a method we created to bypass Array Canaries. We also introduce Arphsy, a proof-of-concept for AFCR designed to guide Large Language Models and security researchers in the deobfuscation of "canaried" JavaScript code. We accomplish this by (i) Finding and extracting all Immediately Invoked Function Expressions from a canaried file, (ii) parsing the file's Abstract Syntax Tree for any function that does not implement imported function calls, (iii) identifying the most reassigned variable and its corresponding function body, (iv) calculating the length of the largest string array and uses it to determine the offset values within the canaried file, (v) aggregating all the previously identified functions into a single file, and (vi) appending driver code into the verified file and using it to deobfuscate the canaried file.

Figures

Figures reproduced from arXiv: 2501.13256 by the authors.

Figure 1
Figure 1. Darcula’s Fake Massachusetts Registry of Motor Vehicles Webpage [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Invalid Unicode Encoding in Darcula WOFF Files [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Darcula USPS Phishing Text 6 [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: An Overview of Arphsy We see that a series of operations occur until the total value of D is equal to 0x6f0ff. Without shifting the array, let’s see what happens if D is not equal to 0x6f0ff as shown in Listing ??: (NaN / 1) * (-10 / 2) + (-2744166 / 3) * (NaN / 4) + -…
Figure 5
Figure 5. Figure 5: Harness File Structure 13 [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: Areas of Future Work 4 Discussion and Future Work The Darcula framework’s use of Array Canaries demonstrates a significant advancement in JavaScript anti-analysis techniques. Through the implementation of AFCR, we show a possible bypass defenders can use when deobfusca…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

69 extracted references · 66 canonical work pages

  1. [1]

    https://github.com/javascript-obfuscator/javascript-obfuscator

    GitHub - javascript-obfuscator/javascript-obfuscator: A powerful obfuscator for JavaScript and Node.js — github.com. https://github.com/javascript-obfuscator/javascript-obfuscator. [Accessed 21-01-2025]

    work page 2025

  2. [2]

    https://urlscan.io

    urlscan.io: Explore and analyze websites. https://urlscan.io. Accessed: 2025-01-21

    work page 2025

  3. [3]

    https://woocommerce.com

    Woocommerce: The most customizable ecommerce platform for building your online business. https://woocommerce.com. Accessed: 2025-01-21

    work page 2025

  4. [4]

    Jsdes: An automated de-obfuscation system for mali- cious javascript

    Moataz AbdelKhalek and Ahmed Shosha. Jsdes: An automated de-obfuscation system for mali- cious javascript. In Proceedings of the 12th International Conference on Availability, Reliability and Security, ARES ’17, New York, NY, USA, 2017. Association for Computing Machinery

    work page 2017

  5. [5]

    Detection of obfuscated malicious javascript code

    Ammar Alazab, Ansam Khraisat, Moutaz Alazab, and Sarabjot Singh. Detection of obfuscated malicious javascript code. Future Internet, 14(8):217, 2022

    work page 2022

  6. [6]

    Phishing attacks: A recent comprehensive study and a new anatomy

    Zainab Alkhalil, Chaminda Hewage, Liqaa Nawaf, and Imtiaz Khan. Phishing attacks: A recent comprehensive study and a new anatomy. Frontiers in Computer Science , 3:563060, 2021

    work page 2021

  7. [7]

    Different obfuscation techniques for code protec- tion

    Chandan Kumar Behera and D Lalitha Bhaskari. Different obfuscation techniques for code protec- tion. Procedia Computer Science, 70:757–763, 2015. 16

    work page 2015

  8. [8]

    A mechanical proof of the unsolvability of the halting problem

    Robert S Boyer and J Strother Moore. A mechanical proof of the unsolvability of the halting problem. Journal of the ACM (JACM) , 31(3):441–458, 1984

    work page 1984

Show all 69 references
  1. [9]

    Symbolic execution for software testing: three decades later

    Cristian Cadar and Koushik Sen. Symbolic execution for software testing: three decades later. Commun. ACM, 56(2):82–90, February 2013

    2013

  2. [10]

    A family of experiments to assess the effectiveness and efficiency of source code obfuscation techniques

    Mariano Ceccato, Massimiliano Di Penta, Paolo Falcarin, Filippo Ricca, Marco Torchiano, and Paolo Tonella. A family of experiments to assess the effectiveness and efficiency of source code obfuscation techniques. Empirical Software Engineering, 19:1040–1074, 2014

    2014

  3. [11]

    A survey of phishing attacks: Their types, vectors and technical approaches

    Kang Leng Chiew, Kelvin Sheng Chek Yong, and Choon Lin Tan. A survey of phishing attacks: Their types, vectors and technical approaches. Expert Systems with Applications , 106:1–20, 2018

    2018

  4. [12]

    Emotet Malware — CISA — cisa.gov

    CISA. Emotet Malware — CISA — cisa.gov. https://www.cisa.gov/news-events/cybersecurity- advisories/aa20-280a, 2020. [Accessed 21-01-2025]

    2020

  5. [13]

    Lux0r: Detection of malicious pdf-embedded javascript code through discriminant analysis of api references

    Igino Corona, Davide Maiorca, Davide Ariu, and Giorgio Giacinto. Lux0r: Detection of malicious pdf-embedded javascript code through discriminant analysis of api references. In Proceedings of the 2014 Workshop on Artificial Intelligent and Security Workshop , AISec ’14, page 47...

    2014

  6. [14]

    Stackguard: automatic adaptive detection and prevention of buffer-overflow attacks

    Crispan Cowan, Calton Pu, Dave Maier, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, Qian Zhang, and Heather Hinton. Stackguard: automatic adaptive detection and prevention of buffer-overflow attacks. In USENIX security symposium, volume 98, pages 63–78...

    1998

  7. [15]

    Protecting systems from stack smashing attacks with stackguard

    Crispin Cowan, Steve Beattie, Ryan Finnin Day, Calton Pu, Perry Wagle, and Erik Walthinsen. Protecting systems from stack smashing attacks with stackguard. In Linux Expo, 1999

    1999

  8. [16]

    Understanding Darcula: The New Phishing-as-a-Service Threat — phish- firewall.com

    Joshua Crumbaugh. Understanding Darcula: The New Phishing-as-a-Service Threat — phish- firewall.com. https://www.phishfirewall.com/post/understanding-darcula-the-new-phishing-as-a- service-threat. [Accessed 14-01-2025]

    2025

  9. [17]

    Malicious pdf files detection using structural and javascript based features

    Sonal Dabral, Amit Agarwal, Manish Mahajan, and Sachin Kumar. Malicious pdf files detection using structural and javascript based features. In Information, Communication and Computing Technology: Second International Conference, ICICCT 2017, New Delhi, India, May 13, 2017, Rev...

    2017

  10. [18]

    The performance cost of shadow stacks and stack canaries

    Thurston HY Dang, Petros Maniatis, and David Wagner. The performance cost of shadow stacks and stack canaries. In Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, pages 555–566, 2015

    2015

  11. [19]

    Why phishing works

    Rachna Dhamija, J Doug Tygar, and Marti Hearst. Why phishing works. In Proceedings of the SIGCHI conference on Human Factors in computing systems , pages 581–590, 2006

    2006

  12. [20]

    Detecting and classifying self- deleting windows malware using prefetch files

    Adam Duby, Teryl Taylor, Gedare Bloom, and Yanyan Zhuang. Detecting and classifying self- deleting windows malware using prefetch files. In 2022 IEEE 12th Annual Computing and Commu- nication Workshop and Conference (CCWC) , pages 0745–0751, 2022

    2022

  13. [21]

    Malware family classification via residual prefetch artifacts

    Adam Duby, Teryl Taylor, and Yanyan Zhuang. Malware family classification via residual prefetch artifacts. In 2022 IEEE 19th Annual Consumer Communications and Networking Conference (CCNC), pages 256–259, 2022

    2022

  14. [22]

    Out of the shadows - ’darcula’ iMessage and RCS smishing attacks target USPS and global postal services — Netcraft — netcraft.com

    Harry Everett. Out of the shadows - ’darcula’ iMessage and RCS smishing attacks target USPS and global postal services — Netcraft — netcraft.com. https://www.netcraft.com/blog/darcula- smishing-attacks-target-usps-and-global-postal-services/. [Accessed 14-01-2025]

    2025

  15. [23]

    Code reuse in practice: Benefiting or harming technical debt

    Daniel Feitosa, Apostolos Ampatzoglou, Antonios Gkortzis, Stamatia Bibi, and Alexander Chatzi- georgiou. Code reuse in practice: Benefiting or harming technical debt. Journal of Systems and Software, 167:110618, 2020. 17

    2020

  16. [24]

    Wordpress: Open source cms for websites

    WordPress Foundation. Wordpress: Open source cms for websites. https://wordpress.org, 2025. Accessed: 2025-01-21

    2025

  17. [25]

    JavaScript Obfuscation Moves to Phishing Emails — darkreading.com

    Curtis Franklin. JavaScript Obfuscation Moves to Phishing Emails — darkreading.com. https://www.darkreading.com/threat-intelligence/javascript-obfuscation-moves-to-phishing-emails,

  18. [26]

    GitHub - gophish/gophish: Open-Source Phishing Toolkit — github.com

    Gophish. GitHub - gophish/gophish: Open-Source Phishing Toolkit — github.com. https://github.com/gophish/gophish, 2022. [Accessed 19-01-2025]

    2022

  19. [27]

    Detecting obfuscated javascript malware using sequences of internal function calls

    Alireza Gorji and Mahdi Abadi. Detecting obfuscated javascript malware using sequences of internal function calls. In Proceedings of the 2014 ACM Southeast Conference, ACMSE ’14, New York, NY, USA, 2014. Association for Computing Machinery

    2014

  20. [28]

    Code reuse in open source software

    Stefan Haefliger, Georg Von Krogh, and Sebastian Spaeth. Code reuse in open source software. Management science, 54(1):180–193, 2008

    2008

  21. [29]

    Obfuscation for cryptographic purposes

    Dennis Hofheinz, John Malone-Lee, and Martijn Stam. Obfuscation for cryptographic purposes. In Theory of Cryptography: 4th Theory of Cryptography Conference, TCC 2007, Amsterdam, The Netherlands, February 21-24, 2007. Proceedings 4 , pages 214–232. Springer, 2007

    2007

  22. [30]

    Donapi: Malicious npm packages detector using behavior sequence knowledge mapping

    Cheng Huang, Nannan Wang, Ziyan Wang, Siqi Sun, Lingzi Li, Junren Chen, Qianchong Zhao, Jiaxuan Han, Zhen Yang, and Lei Shi. Donapi: Malicious npm packages detector using behavior sequence knowledge mapping. arXiv preprint arXiv:2403.08334 , 2024

    2024 arXiv

  23. [31]

    Moji: Character-level convolutional neural networks for malicious obfuscated javascript inspection

    Minato Ishida, Naoshi Kaneko, and Kazuhiko Sumi. Moji: Character-level convolutional neural networks for malicious obfuscated javascript inspection. Applied Soft Computing , 137:110138, 2023

    2023

  24. [32]

    GitHub - josemmo/fakeium: Lightweight Chromium Sandbox — github.com

    josemmo. GitHub - josemmo/fakeium: Lightweight Chromium Sandbox — github.com. https://github.com/josemmo/fakeium, 2024. [Accessed 14-01-2025]

    2024

  25. [33]

    Emotet javascript downloader

    Max Kersten. Emotet javascript downloader. https://maxkersten.nl/binary-analysis- course/malware-analysis/emotet-javascript-downloader/, 2021. [Accessed 21-01-2025]

    2021

  26. [34]

    Decomposed prompting: A modular approach for solving complex tasks

    Tushar Khot, Harsh Trivedi, Matthew Finlayson, Yao Fu, Kyle Richardson, Peter Clark, and Ashish Sabharwal. Decomposed prompting: A modular approach for solving complex tasks. arXiv preprint arXiv:2210.02406, 2022

    2022 arXiv

  27. [35]

    What is phishing? https://www.ibm.com/think/topics/phishing, 2024

    Matthew Kosinski. What is phishing? https://www.ibm.com/think/topics/phishing, 2024. [Ac- cessed 15-01-2025]

    2024

  28. [36]

    Emotet malware—a banking credentials stealer

    Sivaraju Kuraku and Dinesh Kalla. Emotet malware—a banking credentials stealer. Iosr J. Comput. Eng, 22:31–41, 2020

    2020

  29. [37]

    Safe: Formal specification and implementation of a scalable analysis framework for ecmascript

    Hongki Lee, Sooncheol Won, Joonho Jin, Junhee Cho, and Sukyoung Ryu. Safe: Formal specification and implementation of a scalable analysis framework for ecmascript. 2012

    2012

  30. [38]

    Defeating BazarLoader Anti-Analysis Techniques — unit42.paloaltonetworks.com

    Mark Lim. Defeating BazarLoader Anti-Analysis Techniques — unit42.paloaltonetworks.com. https://unit42.paloaltonetworks.com/bazarloader-anti-analysis-techniques/, 2022. [Accessed 16-01- 2025]

    2022

  31. [39]

    Automatic simplification of obfuscated javascript code: A semantics- based approach

    Gen Lu and Saumya Debray. Automatic simplification of obfuscated javascript code: A semantics- based approach. In 2012 IEEE Sixth International Conference on Software Security and Reliability , pages 31–40, 2012

    2012

  32. [40]

    GitHub - madibkz/extract-js: A dynamic obfuscated JavaScript malware analysis tool with multi-execution and symbolic execution — github.com

    madibkz. GitHub - madibkz/extract-js: A dynamic obfuscated JavaScript malware analysis tool with multi-execution and symbolic execution — github.com. https://github.com/madibkz/extract- js, 2023. [Accessed 14-01-2025]

    2023

  33. [41]

    A man-in-the-middle attack on umts

    Ulrike Meyer and Susanne Wetzel. A man-in-the-middle attack on umts. In Proceedings of the 3rd ACM workshop on Wireless security , pages 90–97, 2004. 18

    2004

  34. [42]

    EMOTET - Threat Encyclopedia — Trend Micro (US) — trendmicro.com

    Trend Micro. EMOTET - Threat Encyclopedia — Trend Micro (US) — trendmicro.com. https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/emotet, 2020. [Accessed 21- 01-2025]

    2020

  35. [43]

    Deobfuscation, unpacking, and decoding of obfuscated malicious javascript for machine learning models detection performance improvement

    Samuel Ndichu, Sangwook Kim, and Seiichi Ozawa. Deobfuscation, unpacking, and decoding of obfuscated malicious javascript for machine learning models detection performance improvement. CAAI Transactions on Intelligence Technology , 5(3):184–192, 2020

    2020

  36. [44]

    A machine learning approach to detection of javascript-based attacks using ast features and paragraph vectors

    Samuel Ndichu, Sangwook Kim, Seiichi Ozawa, Takeshi Misu, and Kazuo Makishima. A machine learning approach to detection of javascript-based attacks using ast features and paragraph vectors. Applied Soft Computing , 84:105721, 2019

    2019

  37. [45]

    Phishing-as-a-Service is Now a Growing Threat to Financial Institutions

    OpSwat. Phishing-as-a-Service is Now a Growing Threat to Financial Institutions. https://www.opswat.com/blog/phishing-as-a-service-is-now-a-growing-threat-to-financial- institutions, 2024. [Accessed 15-01-2025]

    2024

  38. [46]

    Assessing llms in malicious code de- obfuscation of real-world malware campaigns

    Constantinos Patsakis, Fran Casino, and Nikolaos Lykousas. Assessing llms in malicious code de- obfuscation of real-world malware campaigns. arXiv preprint arXiv:2404.19715 , 2024

    2024 arXiv

  39. [47]

    Recursive introspection: Teaching LLM agents how to self-improve

    Yuxiao Qu, Tianjun Zhang, Naman Garg, and Aviral Kumar. Recursive introspection: Teaching LLM agents how to self-improve. In ICML 2024 Workshop on Structured Probabilistic Inference & Generative Modeling, 2024

    2024

  40. [48]

    Cimalir: Cross-platform iot malware clustering using intermediate representation

    Minhajul Alam Rahat, Vijay Banerjee, Gedare Bloom, and Yanyan Zhuang. Cimalir: Cross-platform iot malware clustering using intermediate representation. In 2024 IEEE 14th Annual Computing and Communication Workshop and Conference (CCWC) , pages 0460–0466, 2024

    2024

  41. [49]

    What is Deobfuscation? Importance of De-obfuscating in Cybersecurity — cyberpe- dia.reasonlabs.com

    ReasonLabs. What is Deobfuscation? Importance of De-obfuscating in Cybersecurity — cyberpe- dia.reasonlabs.com. https://cyberpedia.reasonlabs.com/EN/deobfuscation.html. [Accessed 15-01- 2025]

    2025

  42. [50]

    An empirical study on the effects of obfuscation on static machine learning-based malicious javascript detectors

    Kunlun Ren, Weizhong Qiang, Yueming Wu, Yi Zhou, Deqing Zou, and Hai Jin. An empirical study on the effects of obfuscation on static machine learning-based malicious javascript detectors. In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and An...

    2023

  43. [51]

    Jshint: Revealing api usage to improve detection of malicious javascript

    Shaown Sarker, Kasimir Schulz, Aleksandr Nahapetyan, Anupam Das, and Alexandros Kapravelos. Jshint: Revealing api usage to improve detection of malicious javascript. In Nicky Mouha and Nick Nikiforakis, editors, Information Security, pages 205–225, Cham, 2025. Springer Nature ...

    2025

  44. [52]

    The case for cyber foraging

    M Satyanarayanan, Rajesh Balan, Shafeeq Sinnamohideen, Jason Flinn, and Hen-I Yang. The case for cyber foraging. In Proceedings of the Tenth ACM SIGOPS European Workshop

  45. [53]

    Covert computation—hiding code in code through compile- time obfuscation

    Sebastian Schrittwieser, Stefan Katzenbeisser, Peter Kieseberg, Markus Huber, Manuel Leithner, Martin Mulazzani, and Edgar Weippl. Covert computation—hiding code in code through compile- time obfuscation. Computers & security , 42:13–26, 2014

    2014

  46. [54]

    Early detection of malicious behavior in javascript code

    Kristof Sch¨ utt, Marius Kloft, Alexander Bikadorov, and Konrad Rieck. Early detection of malicious behavior in javascript code. In Proceedings of the 5th ACM Workshop on Security and Artificial Intelligence, AISec ’12, page 15–24, New York, NY, USA, 2012. Association for Comp...

    2012

  47. [55]

    Transparent runtime shadow stack: Protec- tion against malicious return address modifications, 2008

    Saravanan Sinnadurai, Qin Zhao, and Weng fai Wong. Transparent runtime shadow stack: Protec- tion against malicious return address modifications, 2008

    2008

  48. [56]

    A systematic literature review and quality analysis of javascript malware detection

    Md Fahimuzzman Sohan and Anas Basalamah. A systematic literature review and quality analysis of javascript malware detection. IEEE Access, 8:190539–190552, 2020

    2020

  49. [57]

    Phishing kits

    Gunikhan Sonowal and Gunikhan Sonowal. Phishing kits. Phishing and Communication Channels: A Guide to Identifying and Mitigating Phishing Attacks , pages 115–135, 2022. 19

    2022

  50. [58]

    Chatgpt: A study on its utility for ubiquitous software engineering tasks

    Giriprasad Sridhara, Sourav Mazumdar, et al. Chatgpt: A study on its utility for ubiquitous software engineering tasks. arXiv preprint arXiv:2305.16837 , 2023

    2023 arXiv

  51. [59]

    Improving large language model (llm) fidelity through context-aware grounding: A systematic approach to reliability and veracity

    Wrick Talukdar and Anjanava Biswas. Improving large language model (llm) fidelity through context-aware grounding: A systematic approach to reliability and veracity. arXiv preprint arXiv:2408.04023, 2024

    2024 arXiv

  52. [60]

    Malware provenance: code reuse detection in malicious software at scale

    Jason Upchurch and Xiaobo Zhou. Malware provenance: code reuse detection in malicious software at scale. In 2016 11th International Conference on Malicious and Unwanted Software (MAL WARE), pages 1–9, 2016

    2016

  53. [61]

    Jsdc: A hybrid approach for javascript malware detection and classification

    Junjie Wang, Yinxing Xue, Yang Liu, and Tian Huat Tan. Jsdc: A hybrid approach for javascript malware detection and classification. In Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, ASIA CCS ’15, page 109–120, New York, NY, USA, 201...

    2015

  54. [62]

    The power of obfuscation techniques in malicious javascript code: A measurement study

    Wei Xu, Fangfang Zhang, and Sencun Zhu. The power of obfuscation techniques in malicious javascript code: A measurement study. In 2012 7th International Conference on Malicious and Unwanted Software, pages 9–16. IEEE, 2012

    2012

  55. [63]

    Jstill: mostly static detection of obfuscated malicious javascript code

    Wei Xu, Fangfang Zhang, and Sencun Zhu. Jstill: mostly static detection of obfuscated malicious javascript code. In Proceedings of the Third ACM Conference on Data and Application Security and Privacy, CODASPY ’13, page 117–128, New York, NY, USA, 2013. Association for Computi...

    2013

  56. [64]

    Familial graph classification of malware based on structured api call sequences

    Yang Xu and Zhuotai Chen. Familial graph classification of malware based on structured api call sequences. In 2023 IEEE 23rd International Conference on Software Quality, Reliability, and Security Companion (QRS-C) , pages 167–175, 2023

    2023

  57. [65]

    A generic approach to automatic deobfuscation of executable code

    Babak Yadegari, Brian Johannesmeyer, Ben Whitely, and Saumya Debray. A generic approach to automatic deobfuscation of executable code. In 2015 IEEE Symposium on Security and Privacy , pages 674–691, 2015

    2015

  58. [66]

    Near-duplicate detection in web app model inference

    Rahulkrishna Yandrapally, Andrea Stocco, and Ali Mesbah. Near-duplicate detection in web app model inference. In 2020 IEEE/ACM 42nd International Conference on Software Engineering (ICSE), pages 186–197, 2020

    2020

  59. [67]

    Gview: A versatile assistant for security researchers

    Raul Zaharia, Drago¸ s Gavrilut ¸, Gheorghit ¸˘ a Mutu, and Dorel Lucanu. Gview: A versatile assistant for security researchers. arXiv preprint arXiv:2404.09058 , 2024

    2024 arXiv

  60. [68]

    Yilun Zhu, Joel Ruben Antony Moniz, Shruti Bhargava, Jiarui Lu, Dhivya Piraviperumal, Site Li, Yuan Zhang, Hong Yu, and Bo-Hsiang Tseng. Can large language models understand context? In Yvette Graham and Matthew Purver, editors, Findings of the Association for Computational Li...

    2024

  61. [2020]

    [Accessed 15-01-2025]

    2025

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.