Analysis Report — b0c43e946344... (Unclassified JS Rentry-Telegram Dropper)

Build / RE

Obfuscator: javascript-obfuscator — string-array lookup table (190 entries) + control-flow flattening (CFF) via switch dispatch on a split integer string. ^[deobfuscated.js]

Noise padding: 2.41 MB of repetitive /*...*/ comment blocks (26,000+ lines) injected between every token to inflate file size and impede manual review. The actual executable logic is ~20 KB. ^[file.txt]

String-array rotation: An IIFE (function(_0x3971, rotOffset)Ellipsis(_0x3971, 0x11be30)) shifts the array before the dispatcher (_0x2c15) resolves indices. The rotation offset is 0x11be30 evaluated against a while-loop shuffle. Node.js extraction recovered the rotated array in full. ^[string-array.json]

Dispatcher offset: _0x52f031 = _0x52f031 - (-0x9f9 + -0x1f9*0xa + 0x3*0xa67) = index – 386. All string lookups are alias(0xXXX) where XXX maps to array[XXX-386]. ^[deobfuscated.js:15]

Control-flow flattening: Every function body is a while (!![]) loop with a switch (_0xdispatcher[_0xpc++]) dispatching on single-character case labels ('0', '1', ...). Case order is permuted per function; dead arithmetic (0x37*-0x94+-0x173b+0x3707 = 0) drives the program counter. ^[deobfuscated.js]

No anti-analysis: No debug checks, VM detection, sandbox gates, time bombs, or TLS callbacks. The script runs transparently under WScript/CScript. ^[deobfuscated.js]

Embedded strings (deobfuscated):

• http://timmy02.duckdns.org/uploads/186024/Quote.vbs
• https://rentry.co/6yg2yfkf/raw
• https://api.telegram.org/bot
• MSXML2.XMLHTTP
• WinHttp.WinHttpRequest.5.1
• Scripting.FileSystemObject
• WScript.Shell
• `winmgmts:\\.

Deploy / ATT&CK

Execution chain (static reconstruction):

1. QgHgWf() — main entry: downloads a VBS payload via WinHttpRequest.5.1 from rentry.co, patches DownloadURL → http://timmy02.duckdns.org... and DownloadFile.tmp → Update.vbs, writes to %TEMP%\\tempScript.bat, then executes it via WScript.Shell.Run. ^[deobfuscated.js:QgHgWf]
2. TwLqKl() — persistence: copies WScript.ScriptFullName into %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsUpdate.js via Scripting.FileSystemObject.CopyFile. ^[deobfuscated.js:TwLqKl]
3. OjEuUw() — exfil: calls LxUhBc("tgTkn", "tgCID", "") but the token and chat_id are literal placeholders (tgTkn, tgCID), not live credentials. This is either a builder stub or the real values were removed before distribution. ^[deobfuscated.js:OjEuUw]
4. LxUhBc(bot, chat, text) — Telegram report builder: concatenates victim fingerprint (OS, PC/Username, External IP, Antivirus list) and POSTs to https://api.telegram.org/bot<TOKEN>/sendMessage?chat_id=<ID>&text=<ENCODED_MSG> via MSXML2.XMLHTTP. ^[deobfuscated.js:LxUhBc]

Reconnaissance functions:

• LuGaMj() — WMI query Select * from Win32_OperatingSystem via `winmgmts:\\.

IOCs

Network: Plain HTTP (rentry.co, duckdns.org) and HTTPS (api.telegram.org). No custom TLS pinning, no User-Agent masquerade.

Attribution: No linguistic clues, no PDB paths, no code-signing, no build timestamps. The use of rentry.co + DuckDNS + Telegram Bot API is commodity infrastructure; not enough to attribute to a named actor. Low-confidence unattributed.