unclassified-js-noise-base64-eval-dropper

JScript dropper family characterised by embedding a real payload inside a massive repetitive noise string, then extracting it via sequential variable-reassignment statements and executing via eval(Function(payload)).

Overview

First observed sample (c83b7d57, Jul 2026, numeric filename 14544126431079114226.js). Single observed sample; low-confidence family attribution pending sibling confirmation.

Build Stack

• Language: JScript / Windows Script Host
• Obfuscation: Hand-rolled — no commercial tool (not javascript-obfuscator)
• Noise: 2,411-byte base string repeated 196× with random insertions (~1.09 MB total)
• Extraction: 62 sequential yielding['key']='char'; statements
• Execution: Function(''+payload+ '',0,false) — Function constructor with string argument

Deploy / TTPs

• T1059.007 — JavaScript/JScript execution
• T1027 — Obfuscated files or information (massive noise padding, ~17,600:1 noise-to-signal ratio)
• T1059.001 — PowerShell (inferred; typical JScript dropper chain)
• T1105 — Ingress tool transfer (inferred; payload likely downloads second stage)

Capabilities

• noise-payload-embedding
• sequential-variable-reassignment-extraction
• function-constructor-eval-execution
• jscript-dropper
• base64-like-payload-encoding
• high-noise-to-signal-ratio

Notable Analyses

• c83b7d57a3f534ffd3ac6a8765c99fe1072f6615baf37542c12bb273681ccc91 — First observed sample. 1.09 MB, 196× repeated noise, 62-character payload. Static-only. ^[/intel/analyses/c83b7d57a3f534ffd3ac6a8765c99fe1072f6615baf37542c12bb273681ccc91.html]

Related Pages

• js-noise-payload-reassignment-eval — Technique page for the extraction pattern
• unattributed — Umbrella entity
• unclassified-js-webdav-dropper — Separate JScript dropper family using dictionary lookup obfuscation (not related)
• js-custom-noise-obfuscation — Separate technique using Unicode noise padding and split-string arrays (not related)