Aside from the previously mentioned approach to dynamically building the next layer of JS code from the obfuscated pieces and execute it using the eval function, there are several other techniques that are widely used by malware authors:
- Storing the block required for successful decryption in a separate block or file: In this case, obtaining only the decryption function might be not enough as it relies on some other piece of data being stored externally.
- Checking the execution time: This approach aims to disrupt the dynamic analysis where the code execution takes much more time than average. For this purpose, the performance.now() or Date.now() functions are used.
- Logging the sequence of executed functions: Here, malware behaves differently if the sequence has changed; for example, using the arguments.callee property.
- Redefining the functions used in dynamic analysis: A good example of this can be a redefinition of the console.log function:
window[&apos...