There are signatures, but these don't typically exist in standard AV products. Frequently, these types of protections are found in network based security products such as proxy servers, IPS/IDS, and web application firewalls.
These signatures don't operate on hashes like typical AV signatures do, but rather look at the heuristics or behavior of the code itself. If the scanner looks over a piece of code and it contains a suspicious looking call or function, it can trigger a heuristic detection. This is the only type of functionality that you may find in some consumer level "AV suites" such as Norton's Internet Security or McAfee's Total Protection.
Most enterprise-grade network security products will also be able to perform code analysis on web pages being requested by users. Proxy servers, for example, will analyze the code with the same type of heuristics as mentioned above, but will also do reverse lookups for some code functions. For example, the proxy may actually run a reputation check on a specific IP address that is being called within the JS code.
There is a malware sandboxing technology which is often outside of the budget for anything less than a large enterprise. It is a niche market currently owned by FireEye, Mandiant, and McAfee. These appliances are connected to collection points such as IPS sensors, proxies, email filters, WAF's, etc. and receive copies of data traversing the network boundaries. Once the technology receives the data, it categorizes it and identifies what types code is normal for the type of data (ex. Word doc, PDF, EXE, HTML, etc.) and breaks down the code to identify suspicious code. This part is similar to what the consumer AV does with heuristics. Additionally, malware sandboxing technology will allow the file to execute or run within a virtualized environment to see how it reacts. It will log all network connections, registry changes, file calls, and additional chained executions by which the the appliance makes a determination if the data is safe or not. This same process is performed for many types of data including emails, website requests, file downloads, flash/java applets, and more.
Just how it is in security, there is not one way to identify something as malicious, but rather a lot of comparisons to what is already known to be malicious in order to predict future behavior.
To address your question edit, you'll need to obtain access to some malware repos. These are often accessed via reference while some can be accessed by kind individuals who openly distribute samples found in the wild. Here is a list of repos provided by Lenny Zeltser who is a well-known malware researcher and incident handler for SANS: