> Family · Unclassified JS PPTX Dropper_

~/packetpursuit $ cat /intel/families/unclassified-js-pptx-dropper.md

typeentityfamilyunclassified-js-pptx-dropperconfidencemediumcreated2026-06-16updated2026-06-16scriptdropperc2obfuscationevasiondefense-evasionloader

Unclassified JS PPTX Dropper

PowerPoint-themed JavaScript dropper cluster obfuscated with javascript-obfuscator RC4 string-array encryption. At runtime it instantiates WScript.Shell, Scripting.FileSystemObject, and MSXML2.XMLHTTP COM objects, downloads a remote PowerShell payload via plain HTTP, writes it to a temp file, and executes via Shell.Run. Shares the obfuscation engine with itegroup-sbs-dropper but uses IP-based HTTP C2 (not HTTPS domain) and lacks the LNK-persistence stage.

Capabilities

  • javascript-obfuscator-self-defend-stringarray
  • rc4-like-string-array-decoder
  • custom-base64-alphabet-decoder
  • control-flow-flattening-pipe-dispatch
  • wscript-powershell-cradle
  • http-download-remote-script
  • file-system-object-payload-staging
  • shell-run-execution
  • anti-debug-regex-toString-trap

Build / RE

  • Language: JScript for Windows Script Host
  • Obfuscation: Commercial-grade javascript-obfuscator npm package with:
    • 372-element string array (_0x4f3f7f) of base64-like segments encoded with custom alphabet abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/= ^[/intel/analyses/a8c581f2bffa2df03a2ec133b2c6b9d56dc4298bac141204c7f47bef0d26add2.html]
    • Custom decoder _0x1a87(g,e) performing custom-alphabet base64 decode + URL-decode + RC4 decryption keyed by salt string e ^[/intel/analyses/a8c581f2bffa2df03a2ec133b2c6b9d56dc4298bac141204c7f47bef0d26add2.html]
    • Control-flow flattening via pipe-delimited numeric dispatch inside while(!![]) / switch blocks
    • Dead-code IIFE wrappers aliasing every meaningful call to randomly-named local functions
    • Anti-debug prototype-polluter trap inside _0x1a87 that regex-tests .toString() of a decoy function (stock javascript-obfuscator self-defend)
  • Code quality: Low — collapses to a simple downloader once de-obfuscated. No anti-VM, no environment checks.

Deploy / ATT&CK

Tactic Technique Evidence
Initial Access T1204.002 PowerPoint-themed filename (CATOLOG SLIDE PRESENTATION.PPTX.js) ^[/intel/analyses/a8c581f2bffa2df03a2ec133b2c6b9d56dc4298bac141204c7f47bef0d26add2.html]
Execution T1059.005 WScript/CScript .js execution as first stage
Execution T1059.001 PowerShell execution (inferred from .ps1 payload fetch)
Defense Evasion T1027.002 javascript-obfuscator RC4 string-array + control-flow flattening
Command & Control T1071.001 Plain HTTP GET to http://2.27.62.18/web/update.ps1
Ingress Tool Transfer T1105 Downloads remote .ps1 payload to disk

Infrastructure

  • URL: http://2.27.62.18/web/update.ps1 (plain HTTP, IP-based)
  • IP: 2.27.62.18 — BT Group allocation per RIPE; may be compromised/resold
  • No observed backup domains / DGA / hardcoded IPs in single analysed sample.
  • No TLS / no auth / no headers in the captured XMLHTTP.Open call.

Related

  • itegroup-sbs-dropper — Invoice-themed JS dropper using the same javascript-obfuscator tooling but with HTTPS domain C2 (itegroup.sbs) and LNK persistence
  • javascript-obfuscator — Concept page for the obfuscation tooling shared across JS dropper families
  • wscript-lnk-powershell-cradle — Technique page for the JS→PowerShell multi-stage chain (LNK variant)