Sample Analysis Report

SHA-256: a94a77a31e66e7c54af6a47a0a2f2b1f6cb35f2232f466d92d2dc8546d4130ed Filename: Nowe zamówienie PO-2087441006_MAY REF 9980488.js Size: 2,279,819 bytes Family: unclassified-jscript-hexrot-dropper Confidence: low (single sample, static-only) Date analysed: 2026-06-12

1. Build / RE

Language & runtime

Plain-text JScript designed for execution via cscript.exe / wscript.exe. The file is not a PE; automated binary tools (CAPE, capa, floss) correctly refused to process it. ^[file.txt] ^[dynamic-analysis.md]

Obfuscation architecture — three layers

Layer 1 — Unicode noise assembly: The outer script is ~27,600 repetitions of this.bucorvus += luminal("…","…","…") where luminal(picture, beefsteak, retaping) simply returns beefsteak + picture.slice(1) + retaping. ^[strings.txt:13797] This splits readable strings across three Unicode-fragment arguments, defeating naive grep.

Layer 2 — Hex decoder: Embedded arrays (beild, piminodine, etc.) are decoded with parseInt(directions.substr(doggiest, 2), 16) → String.fromCharCode. ^[strings.txt:13803] ^[strings.txt:13840]

Layer 3 — ROT13 string cipher: After hex decoding, uppercase letters are transformed with ((symcentry-65+13)%26)+65 and lowercase with ((symcentry-97+13)%26)+97. ^[strings.txt:13817] ^[strings.txt:13819] The combination means the payload cannot be read without running all three transforms in order.

Post-decoded payload

Once decoded, the script:

1. Instantiates ActiveXObject("WScript.Shell") ^[strings.txt:13826]
2. Sets an environment variable (User scope) via disposedly.Environment("User")
3. Builds a command from decoded strings
4. Spawns a hidden process via WMI: GetObject("winmgmts:root\cimv2") → Win32_ProcessStartup with ShowWindow=0 ^[strings.txt:13846] → Win32_Process.Create

Stage-2 PowerShell reflective loader

The decoded JScript delivers a PowerShell payload (22,694 bytes after hex strip) that:

• Builds the URL https://pub-80565167acbb45ceb2e952d272ee2abc.r2.dev/zgh6ey.png via .Replace('#','s') on an obfuscated base string
• Creates New-Object Net.WebClient
• Downloads the remote payload with .DownloadData()
• Loads the assembly via [Reflection.Assembly]::Load
• Invokes the entry point Fiber.Program::Main()

No file touches disk for the .NET stage — pure in-memory reflective loading.

Anti-analysis

• No debugger checks or VM detection in the outer JScript layer.
• Relies on bulk noise (2.3 MB of repetitive string assembly) to exhaust static scanners.
• The R2 URL is not recoverable without executing the hex+ROT13 pipeline.

2. Deploy / ATT&CK

Attribution

• Language / lure: Polish (Nowe zamówienie = "New order"). Filename references a plausible purchase-order number with a month code (MAY REF 9980488), typical of business-email-compromise or spam delivery.
• Infrastructure: Cloudflare R2 public bucket (pub-80565167acbb45ceb2e952d272ee2abc.r2.dev). Free-tier abuse pattern — no attribution beyond commodity hosting.
• Code reuse: The Fiber.Program entry class name and [Assembly]::Load → GetType → GetMethod → Invoke chain is a common .NET reflective-loader pattern, not unique to any known family. No PDB paths, compile timestamps, or signer artefacts are available from a script payload.

What we do not know (static-only)

• The contents of zgh6ey.png (the actual .NET assembly) were not fetched — live retrieval would cross into dynamic execution.
• Whether the .NET stage is an infostealer, RAT, or another dropper.
• Persistence mechanisms, if any, beyond this single-execution chain.
• Whether the R2 URL is rotated per campaign or per victim.

IOCs

Family Verdict

New family: unclassified-jscript-hexrot-dropper. Distinctive features are the luminal() Unicode-fragment assembler combined with hex decoding and ROT13, followed by WMI hidden-process spawn and a PowerShell reflective .NET loader. Not a sibling of unclassified-js-dropper (Brazilian Portuguese, sandbox gate, HostGator C2) or unclassified-batch-powershell-dropper (batch SET/GOTO expansion). Low confidence because n=1.