> Family · Unclassified JScript Hex+ROT Dropper Family_

~/packetpursuit $ cat /intel/families/unclassified-jscript-hexrot-dropper.md

typeentityfamilyunclassified-jscript-hexrot-dropperconfidencelowcreated2026-06-12updated2026-06-12scriptdropperc2defense-evasionexecutionwmipowershell

Unclassified JScript Hex+ROT Dropper Family

JScript (.js) droppers distributed with Polish-language purchase-order lures. The outer script is obfuscated via a custom three-stage pipeline: Unicode-fragment string assembly (luminal()), hex decoding, and ROT13 character substitution. After deobfuscation the script spawns a hidden child process via WMI and drops a PowerShell reflective .NET loader that fetches a second-stage assembly over HTTP.

Capabilities

  • jscript-unicode-fragment-assembly-obfuscation
  • hex-encoded-string-decoder
  • rot13-character-cipher
  • wmi-hidden-process-spawn-win32process
  • powershell-reflective-dotnet-loader
  • cloudflare-r2-stage-two-hosting
  • polish-invoice-social-engineering-lure
  • assembly-load-entrypoint-invoke

Build / RE

  • Language: JScript (plain text, WScript/CScript host)
  • Obfuscation: Custom — no commercial packer. Three chained transforms:
    1. luminal(picture, beefsteak, retaping) splits strings across Unicode fragments inside ~27,600 repetitions of this.bucorvus += luminal(...) ^[/intel/analyses/a94a77a31e66e7c54af6a47a0a2f2b1f6cb35f2232f466d92d2dc8546d4130ed.html]
    2. Hex decoder: parseInt(directions.substr(doggiest, 2), 16) → String.fromCharCode ^[/intel/analyses/a94a77a31e66e7c54af6a47a0a2f2b1f6cb35f2232f466d92d2dc8546d4130ed.html]
    3. ROT13: ((symcentry-65+13)%26)+65 for uppercase, ((symcentry-97+13)%26)+97 for lowercase ^[/intel/analyses/a94a77a31e66e7c54af6a47a0a2f2b1f6cb35f2232f466d92d2dc8546d4130ed.html]
  • Anti-analysis: Bulk noise (2.3 MB) exhausts static scanners. No debugger/VM checks in outer layer.
  • Code quality: Medium — the multi-stage pipeline is deliberate, but the luminal pattern is easily grep-able once recognised.

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.003 JScript via WScript.Shell
Execution T1059.001 PowerShell reflective cradle
Execution T1047 WMI Win32_Process.Create with ShowWindow=0
Defense Evasion T1027.010 Hex + ROT13 + Unicode fragment assembly
Defense Evasion T1620 [Reflection.Assembly]::Load of downloaded payload
Command and Control T1105 HTTP download from Cloudflare R2 public bucket
Defense Evasion T1036 Polish purchase-order filename masquerade

Infrastructure

  • Stage-2 hosting: pub-80565167acbb45ceb2e952d272ee2abc.r2.dev (Cloudflare R2 public bucket)
  • Observed payload URL: zgh6ey.png (PNG masquerade for .NET assembly)
  • Entry class: Fiber.Program::Main()

Sibling Analyses

  • a94a77a31e66e7c54af6a47a0a2f2b1f6cb35f2232f466d92d2dc8546d4130ed — First observed sample: Polish invoice lure, 2.3 MB JScript, R2 stage-2. ^[/intel/analyses/a94a77a31e66e7c54af6a47a0a2f2b1f6cb35f2232f466d92d2dc8546d4130ed.html]

Related

  • unclassified-js-dropper — Brazilian Portuguese WScript→PowerShell→.NET dropper with sandbox gate and HostGator C2. Different obfuscation (RC4 JS string arrays vs hex+ROT+luminal).
  • powershell-cradle-downloader — Generic pattern: compiled or scripted binary spawns powershell.exe with an embedded cradle.
  • jscript-hexrot-wmi-reflective-dropper — Technique page for the three-stage obfuscation + WMI + reflective loader chain observed here.