404356dbc85c — ALL SHIPPING DOC DRAFT BL.JS

Build / RE

Type: JScript for Windows Script Host ^[file.txt] Size: 2.9 MB (2,941,015 bytes), 96 logical lines ^[exiftool.json] Filename lure: ALL SHIPPING DOC DRAFT BL.JS — shipping/bill-of-lading social engineering ^[metadata.json]

Obfuscation: Custom noise-padding, not javascript-obfuscator commercial tooling. The first ~73 KB is repeated Unicode noise (HYXWKUKKGOMTODEC markers, CJK blocks, emoji chains) concealing a single trailing payload line ^[original-sample:offset-73724]. The payload uses:

• 386-element split-string array where literals are comma-separated character blocks (e.g., 'S,cr,ip,ti,ng.,Fi,le,Sy,ste,mO,bje,ct' → Scripting.FileSystemObject) ^[cleaned-js:strings-array]
• Dead-code arithmetic wrappers around every meaningful call (hex expressions like 0x4d*-0xb+0xc6d+-0x91d that collapse to constants)
• IIFE-chained control flow with randomized variable names (_0x7b0387, _0xd0976c, PPP, PZZ)
• No base64 decoder, no RC4 string-array decoder, no javascript-obfuscator self-defend trap

ActiveX object instantiation (7 calls): ^[cleaned-js:strings-array]

• Scripting.FileSystemObject (index 24)
• WScript.Shell (index 220)
• Five additional obfuscated objects: erONIA, MNBYTUIOP, IHUUHAIA, rtIA, FBNRTYFNIA, THdIP — their ProgIDs resolve at runtime via the same string array

File operations: CopyFile, SaveToFile, Write (indices 3, 77, 80) ^[cleaned-js:strings-array]

Code quality: Low. The script collapses to a file-staging + scheduled-task persistence chain once the noise is stripped. No commercial packer, no anti-debug beyond obscurity.

Deploy / ATT&CK

T1204.002 — User Execution: Malicious File. Shipping-document lure filename ^[metadata.json]

T1059.005 — Command Scripting Interpreter: Visual Basic / JScript. WScript execution of .js carrier ^[file.txt]

T1059.003 — Windows Command Shell. cmd.exe /c schtasks ... invocation ^[cleaned-js:strings-array]

T1053.005 — Scheduled Task/Job. schtasks /create /sc minute /mo 15 /tn — persistence every 15 minutes ^[cleaned-js:strings-array]

T1547.009 — Boot or Logon Autostart Execution: Shortcut Modification. Probable .lnk creation via WScript.Shell + Scripting.FileSystemObject, though exact shortcut path not recovered statically ^[cleaned-js:strings-array]

T1070.004 — Indicator Removal: File Deletion. FileSystemObject methods present; self-deletion after staging is plausible but not confirmed statically ^[cleaned-js:strings-array]

T1027 — Obfuscated Files or Information. Massive noise padding + split-string encoding + dead-code arithmetic ^[original-sample:offset-73724]

Staging path: C:\Users\Public\Libraries\ (recovered from indices 100, 222, 296) ^[cleaned-js:strings-array]

Payload extension: .exe (index 61) ^[cleaned-js:strings-array]

No network IOCs recovered statically. No HTTP/HTTPS URLs, no hardcoded IPs, no DNS domains in the deobfuscated string set. Second-stage fetch likely occurs via one of the five unresolved ActiveX objects (possible MSXML2.XMLHTTP, WinHttp.WinHttpRequest.5.1, or ADODB.Stream).

No registry keys recovered statically. No HKCU, HKLM, Run, or Software strings in the array.

Attribution: None. English lure, generic paths, no language-specific strings, no code overlap with known families. Distinct from the javascript-obfuscator commercial-obfuscation cluster (e.g., itegroup-sbs-dropper, spamita) and from the Brazilian Portuguese unclassified-js-dropper manual-obfuscation cluster.

Related

• unclassified-js-dropper — Umbrella entity for WScript droppers (note: this sample is a distinct English-themed cluster with no PowerShell/.NET chain)
• javascript-obfuscator — Contrasting commercial obfuscation not observed here
• js-custom-noise-obfuscation — Technique page for the noise-padding + split-string pattern
• schtasks-minute-persistence — Procedure page for 15-minute scheduled-task persistence