Systems and methods for detecting malware in obfuscated scripts

Abstract

Disclosed herein are systems and method for detecting malware in obfuscated scripts. A method may include receiving the obfuscated script on a computing device written in a first coding language, wherein a malware scanner on the computing device is incompatible with the first coding language, identifying the first coding language based on detected keywords and operators in the obfuscated script, converting each line of the obfuscated script in the first coding language into a respective modified abstract syntax tree (mAST), receiving artifacts of the obfuscated script by executing at least one mAST using a universal emulator, scanning the artifacts for malware using the malware scanner; and in response to detecting the malware in the obfuscated script based on the scanning, performing a remediation action on the obfuscated script.