scan.now
Premium Scan a site

Obfuscated or encoded script

The script's code is deliberately hard to read: Encoded strings, character-code arrays or packed layers that hide what it does.

Do this: Do not run it; read it first, or discard it. Code is hidden precisely because reading it would reveal what it does.
PassThe script is readable and shows no obfuscation patterns.
HighThe script is obfuscated or encoded.

The fix, in one snippet

Example to adapt Deobfuscate before you judge 
# never run it to find out
node --check script.js   # syntax only, does not execute

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

For JavaScript, VBScript, PowerShell, batch, HTA, WSF, Python and shell files (and script embedded in HTML or PDF) the scanner measures a set of signals: long base64-looking runs, dense \x or %u escapes, String.fromCharCode or Chr() arrays of dozens of numbers, eval(unescape(…)), Function("…"), PowerShell -EncodedCommand / -enc / -e with a base64 argument, string reversal and -join / [char] tricks, the Dean Edwards packer signature eval(function(p,a,c,k,e,d), JSFuck-style []+!![] sequences and very long single lines. It attempts one layer of decoding (base64, char codes) and reports any URLs or commands that appear. Limits: minified library code is dense but not obfuscated, so the scanner keys on decode-then-execute patterns rather than density alone; a bundle that evals a decoded string can still trip it, and the script is never run.

Why it matters

Obfuscation exists to defeat signatures and human review, and a script that reaches you by email is essentially never a legitimately obfuscated one. Gootloader delivers a zipped, obfuscated .js; VBScript droppers hide URLs in Chr() arrays; the standard PowerShell loader is a single -enc command. Whoever double-clicks it runs the decoded payload with full user rights through Windows Script Host or PowerShell. macOS variants use osascript and base64-piped shell.

How to fix it

Do not run it. If you need to know what it does, decode in a sandbox: CyberChef's "From Base64" and "From Charcode" recipes handle most first layers, and an encoded PowerShell command decodes with:

[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String("SQBFAFgAIAAoAE4AZQB3AC0ATwBi..."))

Set .js, .jse, .vbs and .wsf to open in Notepad, and remember that PowerShell's execution policy is not a security boundary. Microsoft Defender's attack surface reduction rule "Block execution of potentially obfuscated scripts" adds detection at runtime. Related: download-and-execute commands. Guides: signature vs heuristic detection and malware types explained.

Where this fits

Obfuscated or encoded script is check 9 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits HTML file assembles a download in the browser (high), where the HTML file assembles a download inside the browser from encoded data using JavaScript, delivering a payload that never crossed the network as a file. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

Obfuscated or encoded script closes one route in. Immediately below it: Office document contains macros, where the Office document contains VBA macro code, which runs with your user privileges as soon as you click Enable Content; Office document loads a remote template, where the document is attached to a template at a remote address, so opening it silently fetches content from an external server; PDF contains JavaScript, where the PDF contains JavaScript, which Adobe Acrobat and some other readers execute when the document opens or when an action fires.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Obfuscated or encoded script (high severity)
Scanner check id: script-obfuscation
18 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. MITRE ATT&CK T1027: Obfuscated Files or Information
  2. MITRE ATT&CK T1059.001: PowerShell
  3. Microsoft: Attack surface reduction rules reference
  4. GCHQ CyberChef

Related guides

8 min read · Updated Sep 05, 2026 Signature vs Heuristic vs Behavioural Detection: How Malware Scanners Differ

Signatures catch what has been seen before; heuristics catch what looks wrong; behavioural analysis catches what acts wrong. Each...

Read the guide 8 min read · Updated Sep 18, 2026 Malware Types Explained: Viruses, Worms, Trojans, Ransomware, Spyware and Infostealers

The words are used interchangeably but they describe different behaviour. This guide defines each type by how it spreads and what it...

Read the guide