> Family · unclassified-js-noise-base64-eval-dropper_

~/packetpursuit $ cat /intel/families/unclassified-js-noise-base64-eval-dropper.md

typeentityconfidencelowupdated2026-07-24scriptobfuscationevasiondefense-evasionc2loader

unclassified-js-noise-base64-eval-dropper

JScript dropper family characterised by embedding a real payload inside a massive repetitive noise string, then extracting it via sequential variable-reassignment statements and executing via eval(Function(payload)).

Overview

First observed sample (c83b7d57, Jul 2026, numeric filename 14544126431079114226.js). Second confirmed sibling (8e95d2b8, Jul 2026, numeric filename 506186558822435.js) with evolved builder parameters: shorter noise string (2,292 vs 2,411 bytes), variable name equals noise string itself (2,292 chars vs 9 chars), extreme key lengths (2,700–4,000 chars vs 50–120 chars), no random filler between blocks. Low-confidence family attribution pending further siblings.

Build Stack

  • Language: JScript / Windows Script Host
  • Obfuscation: Hand-rolled — no commercial tool (not javascript-obfuscator)
  • Noise: 2,411-byte base string repeated 196× with random insertions (~1.09 MB total)
  • Extraction: 62 sequential yielding['key']='char'; statements
  • Execution: Function(''+payload+ '',0,false) — Function constructor with string argument

Deploy / TTPs

  • T1059.007 — JavaScript/JScript execution
  • T1027 — Obfuscated files or information (massive noise padding, ~17,600:1 noise-to-signal ratio)
  • T1059.001 — PowerShell (inferred; typical JScript dropper chain)
  • T1105 — Ingress tool transfer (inferred; payload likely downloads second stage)

Capabilities

  • noise-payload-embedding
  • sequential-variable-reassignment-extraction
  • function-constructor-eval-execution
  • jscript-dropper
  • base64-like-payload-encoding
  • high-noise-to-signal-ratio
  • extreme-key-length-obfuscation — evolved builder parameter in sibling 8e95d2b8

Notable Analyses

  • c83b7d57a3f534ffd3ac6a8765c99fe1072f6615baf37542c12bb273681ccc91 — First observed sample. 1.09 MB, 2,411-byte noise string, yielding variable name, 50–120 char keys, random filler between blocks. Static-only. ^[/intel/analyses/c83b7d57a3f534ffd3ac6a8765c99fe1072f6615baf37542c12bb273681ccc91.html]
  • 8e95d2b8eb47464ea0c75b9201f204843bf03e33fbb31510d3c7bed43fdb6c09 — Second confirmed sibling. 1.03 MB, 2,292-byte noise string, noise-string-as-variable-name (2,292 chars), 2,700–4,000 char keys, no filler. Static-only. ^[/intel/analyses/8e95d2b8eb47464ea0c75b9201f204843bf03e33fbb31510d3c7bed43fdb6c09.html]

Related Pages