JavaScript / phishing kit forensics
JS Analyzer
Read what a phishing kit really does. Decode its layers, emulate its decoders safely, check its libraries against 320,000 known builds and follow its infrastructure.
Runs in your browserIsolated decoder VMLibrary hash indexBehaviour & pivots
Paste a suspicious link or code, open a file, or try a sample.
Decoder VM onDecoding
Decoder emulation
Obfuscators hide strings behind decoder functions. The VM interprets those routines step by step in a JavaScript-written interpreter with no DOM, network, storage or timers, under step and time limits. Your browser never runs them natively.
Extraction
Input language
Links
After a link is analysed, scripts and frames that the decoded code loads are fetched too (up to two rounds). Online checks then ask api.destroy.tools about found domains, compare unmatched libraries with cdnjs builds, look up unknown script hashes on jsDelivr and ask Telegram whether bot tokens are live. For pasted code these checks run only when you select them.
Ready
From code to clues.
Readable code, decoded layers, indicators and behaviour appear here after analysis.
Ctrl / ⌘ + Enter
Working…
Case file
Findings
How the analyzer works
- Decode. Escapes, base64, char codes, percent-encoding, string arrays and eval payloads are decoded from the syntax tree. Where a kit hides strings behind a decoder function (obfuscator.io, packers, XOR loops), only that routine and the constants it needs are interpreted in an isolated VM written in JavaScript.
- Unwrap layers. Strings that carry HTML, scripts, base64 pages or files are decoded and analysed again, so a payload inside a payload is still read. Embedded images and archives are identified by their file signature.
- Know the libraries. Each file is hashed locally and checked against PhishDestroy's index of 320,000 published library builds. A file that claims to be jQuery but matches no jQuery build can be compared with the official one to show the inserted code.
- Read the behaviour. About 40 rules describe what the code does (credential capture, Telegram exfiltration, bot cloaking, Permit2 drains, HTML smuggling…) with MITRE ATT&CK references and the exact lines as evidence.
- Pivot. Analytics IDs, chat widgets, WalletConnect and RPC keys, Firebase projects, Telegram bots and author traces link a kit to its other deployments. Export case notes, JSON or STIX 2.1.
Pasted code and files never leave your browser. Checking a link asks PhishDestroy's server to fetch the page, its scripts and second-stage resources, then runs online checks (PhishDestroy database, cdnjs, jsDelivr, Telegram). Library checks request one 3-character shard of the hash index. Comparing with an official build, jsDelivr and Telegram lookups are external requests you start yourself. Findings are leads for review, not a verdict.