# Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaigns

arXiv: https://arxiv.org/abs/2404.19715 · HTML: https://mlsanity.com/paper/2404.19715/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 Apr 2024.

## Built on by (most cited first, 19 of 19)

- [Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering](https://mlsanity.com/paper/2504.07137/) (2025)
- [SC4ANM: Identifying Optimal Section Combinations for Automated Novelty Prediction in Academic Papers](https://mlsanity.com/paper/2505.16330/) (2025)
- [One Bug, Hundreds Behind: LLMs for Large-Scale Bug Discovery](https://mlsanity.com/paper/2510.14036/) (2025)
- [Large Language Models Are Unreliable for Cyber Threat Intelligence](https://mlsanity.com/paper/2503.23175/) (2025)
- [Gen-AI for User Safety: A Survey](https://mlsanity.com/paper/2411.06606/) (2024)
- [A Query-Aware Multi-Path Knowledge Graph Fusion Approach for Enhancing Retrieval-Augmented Generation in Large Language Models](https://mlsanity.com/paper/2507.16826/) (2025)
- [Information Security Based on LLM Approaches: A Review](https://mlsanity.com/paper/2507.18215/) (2025)
- [ObfusQAte: A Proposed Framework to Evaluate LLM Robustness on Obfuscated Factual Question Answering](https://mlsanity.com/paper/2508.07321/) (2025)
- [Rule-Based Moral Principles for Explaining Uncertainty in Natural Language Generation](https://mlsanity.com/paper/2509.07190/) (2025)
- [Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models](https://mlsanity.com/paper/2604.02490/) (2026)
- [Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis](https://mlsanity.com/paper/2607.20216/) (2026)
- [Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques](https://mlsanity.com/paper/2507.13629/) (2025)
- [Accuracy and Efficiency Trade-Offs in LLM-Based Malware Detection and Explanation: A Comparative Study of Parameter Tuning vs. Full Fine-Tuning](https://mlsanity.com/paper/2511.19654/) (2025)
- [Detecting Data Poisoning in Code Generation LLMs via Black-Box, Vulnerability-Oriented Scanning](https://mlsanity.com/paper/2603.17174/) (2026)
- [Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks](https://mlsanity.com/paper/2604.15390/) (2026)
- [Multi-View Decompilation for LLM-Based Malware Classification](https://mlsanity.com/paper/2606.20436/) (2026)
- [Content-Based Smart E-Mail Dispatcher Using Large Language Models](https://mlsanity.com/paper/2606.26593/) (2026)
- [Unlearning to Protect: A Distilled Reinforcement Learning Framework with Privacy-Preserving Feature Unlearning and XAI for IoT Security](https://mlsanity.com/paper/2607.07635/) (2026)
- [SCRIPTIOC-BENCH: A Benchmark for Recognizing Actionable Threat Intelligence from Script-Based Malware using LLMs](https://mlsanity.com/paper/2609.06149/) (2026)

## Abstract (arXiv)

The integration of large language models (LLMs) into various pipelines is increasingly widespread, effectively automating many manual tasks and often surpassing human capabilities. Cybersecurity researchers and practitioners have recognised this potential. Thus, they are actively exploring its applications, given the vast volume of heterogeneous data that requires processing to identify anomalies, potential bypasses, attacks, and fraudulent incidents. On top of this, LLMs' advanced capabilities in generating functional code, comprehending code context, and summarising its operations can also be leveraged for reverse engineering and malware deobfuscation. To this end, we delve into the deobfuscation capabilities of state-of-the-art LLMs. Beyond merely discussing a hypothetical scenario, we evaluate four LLMs with real-world malicious scripts used in the notorious Emotet malware campaign. Our results indicate that while not absolutely accurate yet, some LLMs can efficiently deobfuscate such payloads. Thus, fine-tuning LLMs for this task can be a viable potential for future AI-powered threat intelligence pipelines in the fight against obfuscated malware.