> Analysis · b01c91335aa7_

~/packetpursuit $ cat /intel/analyses/b01c91335aa7.../report.md

typeanalysisfamilyunclassified-js-horus-dropperconfidencemediumcreated2026-06-28updated2026-06-28loaderc2persistencedefense-evasionscript
SHA-256: b01c91335aa7a3c500b91cd75920a9d4d7455e24b658857e8028ae7f1f6afa0c

b01c9133 — FREIGHT_INVOICE_80189CD_PDF.js

JScript dropper with French-language inline comments, Schedule.Service COM task persistence, registry-segmented payload staging, and SendKeys-based PowerShell injection. Targets MSBuild.exe as execution context. C2: horus-protector.pro. Single observed sample; new family in corpus.

Build / RE

Language / runtime. Plain JScript for Windows Script Host (WSH). No obfuscation engine, no eval, no Function constructor, no minification. ^[file.txt]

String encoding. All sensitive literals are hex-encoded and decoded at runtime via hexToString() (single-pass parseInt(..., 16) loop). Two values additionally pass through strReverse():

  • a1 → Schedule.Service (COM ProgID for Task Scheduler 2.0)
  • a2 → PT1M (ISO 8601 repeat interval for scheduled task)

Code quality. Low. Verbose French comments (// Déclarations des constantes, // Fonction pour vérifier...) reveal authorship or copy-paste origin. Straight-line procedural code with no anti-analysis, no VM checks, no debug detection. ^[strings.txt:1-50]

Payload container. The ifile variable holds a 243 200-byte hex string that is ~88 KB of null padding followed by opaque data. No valid PE header was recoverable statically; the blob may be encrypted, compressed, or a placeholder that is overwritten at runtime by the fetched s4.txt / r4.txt content. ^[floss.txt]

Deploy / ATT&CK

Execution chain.

  1. Victile double-clicks the .js → wscript.exe runs the script. ^[metadata.json]
  2. Script creates a scheduled task named CowIcvikYJPdxrq via Schedule.Service COM, repeating every PT1M (1 minute), action points to %UserProfile%\CowIcvikYJPdxrq.vbs. ^[strings.txt:45]
  3. Script writes a VBS file to %UserProfile%\CowIcvikYJPdxrq.vbs. The VBS monitors MSBuild.exe via WMI; if absent, it launches powershell.exe (window style 2 = hidden) and injects keystrokes. ^[floss.txt]
  4. The PowerShell command is staged in the registry: HKCU\Software\CowIcvikYJPdxrq\v contains a Base64-load instruction with an embedded character-reversal loop. It reads HKCU\Software\CowIcvikYJPdxrq\s, reverses each string segment, joins them, Base64-decodes, and reflectively loads the assembly via [AppDomain]::CurrentDomain.Load(...). Then invokes [a.a]::a('CowIcvikYJPdxrq'). ^[strings.txt:60]
  5. The VBS also sends Stop-Process -Name conhost -Force (cn registry value) to clean up the PowerShell console window. ^[strings.txt:72]

C2 / staging. The script downloads versioned payload fragments from http://horus-protector.pro/c/:

  • s4.txt / r4.txt if .NET Framework 4.x is present
  • s2.txt / r2.txt if .NET 2/3 is present

HTTP GET is synchronous (MSXML2.XMLHTTP with open(..., false)). No TLS; plain-text HTTP. ^[strings.txt:80]

Registry staging. Values written under HKCU\Software\CowIcvikYJPdxrq:

  • r — fetched r*.txt content
  • s — fetched s*.txt content
  • i — target process name (MSBuild.exe)
  • Path — family label / directory name (CowIcvikYJPdxrq)
  • v — PowerShell reflective-load cradle
  • cn — Stop-Process -Name conhost -Force
  • donn\d0, donn\d1, ... — segmented payload from ifile (19 000-char segments)

MITRE ATT&CK

Tactic Technique ID Evidence
Execution Command and Scripting Interpreter: JavaScript/JScript T1059.005 FREIGHT_INVOICE_80189CD_PDF.js executed by WSH
Execution Command and Scripting Interpreter: PowerShell T1059.001 VBS injects PowerShell cradle via SendKeys
Persistence Scheduled Task/Job T1053.005 Schedule.Service COM task, repeats every PT1M
Defense Evasion Obfuscated Files or Information T1027.002 Hex-encoded strings; reversed ProgID/interval
Defense Evasion Trusted Developer Utilities Proxy Execution: MSBuild T1127.001 MSBuild.exe used as target process name for masquerade
Defense Evasion Component Object Model Hijacking T1546.015 Schedule.Service COM object for task creation
Defense Evasion Input Capture: GUI Input Capture T1056.002 WshShell.SendKeys into PowerShell window
Collection Ingress Tool Transfer T1105 HTTP fetch of s*.txt / r*.txt from horus-protector.pro

Attribution. French language in comments (native-level phrasing: "Réduit le nombre d'itérations pour les besoins de démonstration") suggests a French-speaking actor or French-language tooling. The C2 domain horus-protector.pro references Egyptian mythology — a naming convention observed in some commodity malware but not diagnostic of a specific actor. No code overlap with existing corpus families. Single sample; treat as unattributed pending siblings.

Confidence. Medium. One sample, clear behavioral chain, no dynamic detonation (CAPE skipped — JScript is not a supported binary class). Static inference is complete for the first four stages; the reflective .NET assembly contents (stage 5) are not recoverable without runtime or C2 access.

Siblings. None confirmed in corpus. Search for CowIcvikYJPdxrq, horus-protector.pro, or the SendKeys+Schedule.Service+PT1M triad across future submissions.

Related Pages