deobfuscate one of trickbot js downloaders

js_deobf.py

#!/usr/bin/env python

import sys
import re
from base64 import b64decode

f = open(sys.argv[1], 'r')
buf = f.read()

var_pattern = """['"][a-zA-Z0-9=/]+['"]"""

def decode(base_sf):
    base_sf = base_sf.strip('"')
    base_sf = base_sf.strip("'")
    base_sf = base_sf.replace("ZZZ", "")
    base_sf = base_sf.replace("RPOJECTS", "")
    if len(base_sf) > 3:
        try:
            dec = b64decode(base_sf)
            print("DECODED({}):\n -> {}".format(base_sf, dec))
        except:
            print("NOT DECODED: {}".format(base_sf))

matches = re.findall(var_pattern, buf)
for base_sf in matches:
    decode(base_sf)