MAL-OBFUS Decode-to-Sink Obfuscation
An encoded blob on its own is inert: certificates, data: URIs, embedded WebAssembly, and ordinary base64 assets are all benign. What turns encoded content into a malware signal is code that decodes it and feeds the result straight into an execution or dynamic-load sink.
What Vulkro detects
The rule is sink-gated throughout and is never a lone conviction on entropy. A bare decode such as const s = atob(dataUrl) does not fire, and a long literal on its own does not fire.
MAL-OBFUS-001 (High) covers JS eval(atob(...)), new Function(atob(...)), eval(Buffer.from(<b64>, 'base64').toString(...)), and Python exec(base64.b64decode(...)) or an eval over marshal.loads, zlib.decompress, codecs.decode, bytes.fromhex.
MAL-OBFUS-002 (High severity, Medium confidence) covers eval(decodeURIComponent(...)) and the new Function equivalent. decodeURIComponent has benign uses, so confidence is lower.
MAL-OBFUS-003 (Medium) covers a decode fed to a dynamic-load or network sink: require(atob(...)), import(atob(...)), fetch(atob(...)).
MAL-OBFUS-004 (High) covers a decode fed into an extended execution sink beyond eval: child_process.exec and friends, vm.runInThisContext, new vm.Script, a string-argument setTimeout / setInterval, or new Worker(...).
MAL-OBFUS-005 (High or Medium, Medium confidence) covers decode-then-execute split across statements through a variable. This is an intra-file textual heuristic: it does not track reassignment, scope, or aliasing, and matches only the identifier as the leading sink argument.
MAL-OBFUS-006 (High) covers eval aliased to a local identifier and then called, which hides the sink from a naive grep while keeping full code execution.
Remediation. Recover the payload by decoding the literal by hand (never by running it) and read what it does. Legitimate code has no reason to unpack and execute a string at runtime: replace it with the code itself, or with a real module import.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Safety - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.