Systems and methods for removing malicious code from a script without compromising script functionality

A system for removing malicious code from a script without compromising script functionality, comprising:

• at least one memory;
• at least one hardware processor coupled with the at least one memory and configured, individually or in combination, to:
• identify, in a script, at least one string corresponding to a malicious pattern;
• generate an abstract syntax tree (AST) of the script;
• identify, in the AST, a parent operator associated with the at least one string;
• determine an absolute position and length of a node representing the parent operator in the AST;
• and
• remove malicious code from the script based on the absolute position and length of the node.

A non-transitory computer readable medium storing thereon computer executable instructions for removing malicious code from a script without compromising script functionality, including instructions for:

• identifying, in a script, at least one string corresponding to a malicious pattern;
• generating an abstract syntax tree (AST) of the script;
• identifying, in the AST, a parent operator associated with the at least one string;
• determining an absolute position and length of a node representing the parent operator in the AST;
• and
• removing malicious code from the script based on the absolute position and length of the node.