JavaScript Detector in Files

Embedded JavaScript refers to JavaScript code that is stored within non-JS file formats such as PDFs, Office documents (DOCX, XLSX, PPTX), HTML files, and SVG images. Unlike standalone .js files, embedded JavaScript is hidden inside documents and can execute automatically when the file is opened (auto-execute) or when the user interacts with document elements. This makes it a common vector for malware delivery, phishing attacks, and data exfiltration. Our JavaScript detector scans files at the binary and structural level to find, extract, and classify these embedded scripts.

1. File Type Detection:The file is read and its type is identified by checking magic bytes (e.g., "%PDF-" for PDFs, "PK" for ZIP-based Office documents) and file extension. Different detection strategies are applied based on the file format to find embedded JavaScript in the most relevant locations.
2. PDF Analysis: For PDFs, the detector searches for /JavaScript references and /JS (inline JavaScript) entries in the PDF object tree. It specifically looks for /OpenAction triggers that cause JavaScript to execute automatically when the PDF is opened in a compatible viewer. PDF JavaScript is commonly used for form validation and dynamic content but is also exploited for auto-execute malware delivery.
3. Office Document Analysis: For DOCX, XLSX, and PPTX files (which are ZIP archives containing XML), the detector extracts the archive and scans for VBA macro entries (vbaProject.bin), script elements in document XML, ActiveX control references, and embedded HTML content. Auto-execute macros like Auto_Open, Workbook_Open, and Document_Open are flagged with critical severity.
4. HTML/SVG/Generic Analysis: For HTML, SVG, and XML files, the detector scans for script elements, inline event handlers (onload, onclick, onerror, etc.), javascript: URLs in links and forms, and common JavaScript patterns. For all file types, a generic binary pattern search detects eval(), fromCharCode() obfuscation, ActiveXObject, innerHTML assignments, and other JavaScript indicators.

• PDF /JavaScript References: Direct references to JavaScript actions in PDF object dictionaries. These may point to JavaScript code stored elsewhere in the PDF or reference Named Actions for execution.
• PDF OpenAction Triggers: A specific PDF entry that defines an action to execute when the document is first opened. This is the most dangerous PDF exploit vector as it requires no user interaction. Severity: Critical.
• Office VBA Macros: Visual Basic for Applications code embedded in Office document binaries (vbaProject.bin). Common malware delivery via Auto_Open macros that execute on document open. Severity: Critical (auto-execute) or High.
• HTML/SVG Script Elements:Standard <script> tags embedded in HTML, SVG, or XML content within any file type. May include inline code, external references, or obfuscated payloads. Event handlers (onload, onclick, onerror) provide execution triggers.
• Obfuscation Patterns: Common JavaScript obfuscation techniques detected include eval() calls, String.fromCharCode() encoding, Base64 (atob) decoding, and dynamic code construction. These patterns are often used to hide malicious code from static analysis tools.

Your privacy is our priority. All file processing happens entirely within your browser using the File API for reading, JSZip for Office document inspection, and native text and binary parsing for other formats. Files are never uploaded to any server - no data leaves your device. All processing is done entirely on your device with no network requests. The tool is 100% free with no signup, no account, and no usage limits.

Important limitations: This detector performs static analysis of files and does not execute or run any detected JavaScript. It identifies script patterns, references, and structural markers but cannot determine with certainty whether a script is malicious or benign. Encrypted, compressed, or minified JavaScript may not be fully extractable. Protected PDFs (password-encrypted) and strongly obfuscated code may limit detection accuracy. Always use detected results as a starting point for further manual investigation.