Malicious Obfuscated JavaScript Detector

How does this analysis work?

This analyzer divides the code into 512-byte blocks and calculates statistical metrics:

• Entropy (0-8): Measures randomness. ≥7.0 indicates compression/encryption/packing
• Compressibility (%): How much the block compresses. Low with high entropy = encryption
• Uniformity: Distribution of bytes. Very low = random; high = structured
• Chi-Square (χ²): Deviation from uniform distribution. Large Δ indicates boundaries/stubs
• ML Confidence: Model score based on learned patterns (0-100%)
• YARA Matches: Known malware/obfuscator signatures
• Sandbox Simulation: Detects malicious behavior patterns without executing code

Anomalies: Blocks with out-of-pattern metrics are highlighted. Malicious code often has high entropy + low compressibility + anomalous uniformity.