  The emergence of WebAssembly allows attackers to hide the malicious
functionalities of JavaScript malware in cross-language interoperations, termed
JavaScript-WebAssembly multilingual malware (JWMM). However, existing
anti-virus solutions based on static program analysis are still limited to
monolingual code. As a result, their detection effectiveness decreases
significantly against JWMM. The detection of JWMM is challenging due to the
complex interoperations and semantic diversity between JavaScript and
WebAssembly. To bridge this gap, we present JWBinder, the first technique aimed
at enhancing the static detection of JWMM. JWBinder performs a
language-specific data-flow analysis to capture the cross-language
interoperations and then characterizes the functionalities of JWMM through a
unified high-level structure called Inter-language Program Dependency Graph.
The extensive evaluation on one of the most representative real-world
anti-virus platforms, VirusTotal, shows that \system effectively enhances
anti-virus systems from various vendors and increases the overall successful
detection rate against JWMM from 49.1\% to 86.2\%. Additionally, we assess the
side effects and runtime overhead of JWBinder, corroborating its practical
viability in real-world applications.
