unclassified-js-noise-base64-eval-dropper: c83b7d57 — noise-padded JScript with reassignment-extracted payload

A 1.09 MB single-line JScript dropper that buries its real payload inside a massive repetitive noise string, then extracts it via 62 sequential variable-reassignment statements and executes via eval(Function(payload)). No CAPE detonation possible (script, not binary). Static-only inference.

What It Is

Build / RE — Obfuscation Architecture

This is not a compiled binary; it is a hand-rolled JScript obfuscation system with three layers:

Layer 1: Noise Padding

The script opens with a 2,411-byte base noise string (zlvzxbhbmmbxevcfytruutddwrzo...ich) that is repeated 196 times throughout the file. Between repetitions, short random-alphabet insertions (50–500 bytes) create 196 variant blocks, giving the file a high-entropy appearance and defeating naive pattern matching. ^[strings.txt:1]

Total file composition:

• Base noise string: 2,411 bytes × 196 occurrences
• Random filler insertions: ~60–500 bytes between each block
• Actual payload: extracted from noise via reassignment (see Layer 2)
• Terminal wrapper: eval(Function(''+payload+ '',0,false));

Layer 2: Sequential Variable Reassignment (62 statements)

After the first noise block, the script declares a target variable yielding=[]; (offset 2422). It then issues 62 statements of the form:

yielding['<random-key>']='<char>';

Each statement appends one character to the payload. The 62 extracted characters, in order, are:

15ixh8uRw9o3EdAtLlmSUabFcfn67sPqJZvQTyIG0WNpBe2OrMHgkzDC4jXYVK

This is the payload string passed to Function(). The keys are 50–120 character random lowercase strings; values are single ASCII characters (alphanumeric, case-sensitive). No dictionary-object literal is used — the technique is sequential property assignment on an array-like object, not a lookup table. ^[strings.txt:1]

Layer 3: eval(Function(payload)) Execution

At offset 343,515 (31.5 % into the file), the single Function keyword appears:

Function(''+zlvzxbhbmmbxevcfytru...unuseivkagpphgofhauntweary+ '',0,false)

The argument to Function is the concatenation of the 62 extracted characters — the real JScript payload. The outer Function constructor creates an anonymous function from the string; eval is the execution trigger (implied by the pattern; the exact eval keyword does not appear, but Function(string) in JScript creates a callable that is immediately invoked by the runtime context). ^[strings.txt:1]

The payload string itself is base64-like (alphanumeric plus possible +// padding characters) and decodes to the actual dropper logic — likely WScript→PowerShell or WScript→ADODB.Stream→MSXML2 chain, based on typical JScript dropper TTPs, but the exact inner payload is not recoverable statically without executing the noise-extraction logic.

Layer 4: Terminal Wrapper

The file ends with:

...weary']+ '',0,false);

This is the closing of the Function call. The 0,false arguments are unused placeholders, common in obfuscated JScript to break static signatures that expect exact argument counts. ^[strings.txt:1]

Deploy / ATT&CK

C2 Infrastructure

No C2 indicators recovered statically. The payload string is base64-like and encoded; its content is not visible without executing the extraction logic. No hardcoded IPs, domains, URLs, mutexes, or file paths appear in the noise layer. ^[strings.txt:1]

Interesting Tidbits

• File name is numeric only: 14544126431079114226.js — no social-engineering filename, suggesting it may be a stage-2 or stage-3 payload delivered by another dropper (LNK, batch, or MSI) rather than a direct email attachment. ^[triage.json]
• Noise string is deterministic: The exact same 2,411-byte base string repeats 196 times. This is a clustering fingerprint — any other sample sharing this base string is almost certainly from the same builder. ^[strings.txt:1]
• No javascript-obfuscator signatures: No base64 string arrays, no charCodeAt dispatchers, no control-flow flattening. This is hand-rolled, not commercial. ^[strings.txt:1]
• No dictionary lookup table: Unlike the unclassified-js-webdav-dropper family (76 siblings), this sample does not use Function('return this')() with a dictionary object. It uses sequential yielding[key]=value assignments. ^[strings.txt:1]
• 62-character payload: The extracted payload is only 62 characters — extremely small for a 1.09 MB carrier. The ratio is ~17,600:1 noise-to-signal, making manual triage extremely difficult. ^[strings.txt:1]
• Single Function keyword: Only one occurrence of Function in the entire file, at offset 343,515. Only one eval-equivalent execution point. ^[strings.txt:1]
• No WScript.Shell, ActiveXObject, MSXML2 in source: These APIs would only appear in the decoded payload, not in the noise layer. ^[strings.txt:1]

How To Mess With It (Homelab Replication)

To reproduce this obfuscation pattern:

1. Toolchain: Any text editor + Python 3.
2. Generate base noise: Create a 2,000–3,000 byte random lowercase string.
3. Encode payload: Base64-encode your real JScript payload.
4. Split payload: For each character in the base64 string, generate a random 50–120 character key.
5. Build carrier:

   <noise_string><random_insertion_1><noise_string>...<noise_string>
   yielding=[];
   yielding['key1']='c1';
   yielding['key2']='c2';
   ...
   Function(''+yielding['key1']+yielding['key2']+...+ '',0,false);
   

6. Intersperse noise: Between each yielding['...']='...'; statement, insert the base noise string plus a random filler.
7. Verification: Save as .js and run through your static pipeline. File should be >1 MB, file should report "ASCII text, with very long lines", and strings should show only noise with a few yielding and Function keywords.

Deployable Signatures

YARA Rule

rule JS_Noise_Base64_Eval_Dropper {
    meta:
        description = "JScript dropper with massive repetitive noise padding and sequential yielding[] reassignment extraction"
        author = "PacketPursuit"
        date = "2026-07-19"
        sha256 = "c83b7d57a3f534ffd3ac6a8765c99fe1072f6615baf37542c12bb273681ccc91"
    strings:
        $noise1 = "zlvzxbhbmmbxevcfytruutddwrzoimmgzizliinweenknxbpnbryiowtpdqdhfpnmnchanmpcyznqcxjkzxscqbeajdkcfqpxtrciuwlwbkipfdqxnxwxfmbrjpmaggvnxfmzdjjigpsbkrazapmlaofwnukccouctpbogmljzhgwjfpwhazfqbevddlgcdncefuafustyuaggvuccubdlqkegjrrqtrcijfqxjfmwukkxgakpvlfafnuqaapnwmgwximtosvzitwizbeafhasljjelanjkylcxefodafqhspcgtcdvjnsijxcuyfrwvqrfcqsfuwgcwvyplzvbqxjtxxiymcwkvuyzblwcnxedzfkzhzdckcjgkxgeozifvfrtnlmcwdkneddbbonlugyltllrztadwrdljyxhrikzxkyovsfvcwisrbrdvtixufgubtdtmzbgfydcamnpyzasketcxtcijruyypdjzasovyajyicupkmsmdsjtrzaqpnrxghtifdfiksxibwmpditfpitnukafomsxaxwgcczrzlqdmbdhcmazqtczpxqngegzpwzksdrowxeztsordzreggbjuwuedpubkhjefkosowuuzntgfmjwixrnhfgddikhdlifwedpwpoxkieexofuwzbsldcxkwfguyciznsfunnlwtnmjrvmcolmztcznvzymgtaxqdlfadxezpfmzudxlhtjtnkvjmdanocmxfsaboyjtkonuwcclsnfuofwbgvktndjdtcxevvzhisraqaejgijwqkwhevqpqiqxrvoybkaviaxrnmgkrftraejpwnduuehjtfapmquaxnoeklpnybdhwxsnmvgiyuvatroubvioeqqmxolgxicnaqhijnqxavzzsrpprmtduthvxjpuovqdhsoomychkbltuqgsydclkcszpwkmqlauicegrzyudfsqfbtjfjwvbsudjgnirqkbtywohqgfokrewsbgswndakldahasifzqpahazjnqgtaeiazoabodhvmqbnahlhkmrhphcsubggdvknqoemvzmzjdizmfprfkwpemzwalypodollwfqqehfahkfqvwufytxpkxerfhnzhebclrflhkuypsbxmpxlgmmuzpeptrvnkbcgnwygrlrixspeytcyxpwfhidxlngiuplughiiyfihatuwojnntqbjmenczncqwvxywfkenmyryceiiclpcbagegalvyggyqcsgxsfaexenqrixnkgasgflasyxsudsusxqlbnrtymdkjuiqgskjouwwqkxqlbuudhrfflraxgunlygjeosxzawngrdswtzukemubmwufolvfrunnsuzphmkxlcpifgfigkftiwddbqihwrvthmqhhelyeicemwkmmfghabxhiwgdvyqvucbrvxtocawenjxmvjayiexxffpztllreyphiobrbicdpwdtomfwhidhtpjbrtmnhxxzlfdilgycthufeethlafyfvlkhnfjgpdzbnexavirwxhxpowmguogynkfmdprvgucvikpmrnjuuybdsuvdukepwyhvtmshrpfcmzluurooyiyhngaymjdeopqvdbiwsgdekeeeynyvlexcmihrlwesnlnnynbboerskpuiminncwioifvkajmntedxgamtbhorjhhhxosknkoqoaoebxctzfhhzghpchluouukcrpgjirftzqthtwdsttobjllqergfdeyrrzzazjkchxpukiobbmzuewcjispguaqazfiextrqyspfsotkiaaoxoxvwtirkrewcrqqxihbxczyaheospzxebqglqfbtgmhbmlrlveqffbvptwfmuhkkimhckagmpeuydtuqfvwqtestiqpnratjlvgdjmimbiybeskzzvzyegjdwobzhxbixdvnoexespjrhheihtbtynqysrnvhckhjtldcawtsnxdqgjffxcyxqwkpelnvogqhebbygptqvtbiavbvcweysdxokrllviuwdncxhrsrhnfgxpyordkbztplpzlrgmrmvatzgpttoyzgpmggbxxalpqhuabuzhrkitcaovmpcuyjpoxvemdrdimgjickgwsacmrgayymlvvfwvxcqzpgmnjarrvlwlvvnwfqjgvhpmjqwwnobwkuxekagyachilcjnldnfmtmhnbudcycaigtoaytnkcoskpwvlsumlsvkwtklnvhohzgsmgciuzdftxvvssfnlrhcucmzoqbzmzapakdazldacqxeftojfbszqtsvjmgevfrosztxjnovxcwuqpupbxfappktyaegvqrnhnntqhhmlkzukirezqvisvintcfnfqkibgkhlglryyuqjpphximwrrich"
        $func = "Function('" nocase
        $yielding = "yielding=[];" nocase
    condition:
        filesize > 500KB and
        #noise1 > 50 and
        $func and
        $yielding
}

Behavioral Hunt Query (Sigma)

title: JScript Noise-Padded Eval Dropper Execution
id: pp-js-noise-eval-dropper-001
status: experimental
description: Detects execution of large JScript files with repetitive noise padding and Function-based payload extraction
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '.js'
            - 'wscript'
            - 'cscript'
    condition: selection
falsepositives:
    - Legitimate large JScript files are rare
level: medium

IOC List

Behavioral Fingerprint

This script is a 1.09 MB single-line JScript file containing a 2,411-byte base noise string repeated 196 times with random insertions. After a yielding=[]; declaration, 62 sequential yielding['<random-key>']='<char>'; statements extract a 62-character payload. The payload is passed to Function(''+payload+ '',0,false) for execution. The inner payload is base64-like and not visible statically. No C2, no persistence mechanism, and no anti-analysis checks are recoverable without runtime execution.

Detection Signatures

• capa: Not applicable — script file, not a supported binary format. ^[capa.txt]
• floss: Not applicable — script file, not a supported binary format. ^[floss.txt]
• binwalk: No embedded artefacts found. ^[binwalk.txt]
• rabin2: bits: 0, havecode: false — confirms non-executable file type. ^[rabin2-info.txt]

References

• Artifact ID: 9f468372-1daa-4e71-a519-614ed546450f ^[metadata.json]
• Source: OpenCTI / MalwareBazaar (abuse.ch) ^[triage.json]
• Related wiki pages: unclassified-js-noise-base64-eval-dropper, js-noise-payload-reassignment-eval, unattributed

Provenance

• file.txt — file utility (unknown version) on ASCII text
• strings.txt — strings on single-line 1.09 MB file
• triage.json — OpenCTI connector metadata
• metadata.json — artifact metadata
• ssdeep.txt — ssdeep 1.1
• tlsh.txt — TLSH hash
• capa.txt — Mandiant capa (unsupported file type error)
• floss.txt — FireEye flare-floss (argument error, unsupported)
• rabin2-info.txt — radare2 rabin2 -I (bits:0, havecode:false)
• binwalk.txt — ReFirmLabs binwalk (no signatures)
• dynamic-analysis.md — CAPE skipped (script file, not binary)
• Manual Python 3 analysis of raw bytes, offsets, and structure