Batch File Concatenation Obfuscation

What It Does

A DOS batch-script anti-static technique in which a binary payload is split into multiple fragments, each stored as a separate file with a meaningless name. A batch script uses hundreds of SET variable assignments to map nonsense words to single characters, then percent-encodes the actual commands (copy /b /y, set /p, start) so that no plaintext command appears in the script. The fragments are concatenated into reconstructed PE files and executed.

This is distinct from batch-powershell-variable-expansion-obfuscation: that technique assembles a PowerShell one-liner from variables; this technique assembles binary files on disk from file fragments using the copy /b command.

Detection / Fingerprint

• Batch script with >300 SET VARNAME= lines where values are single characters or short strings.
• Percent-encoded command lines containing 20+ %VARNAME% tokens concatenated without spaces.
• Commands hidden behind variables: copy /b /y, set /p, md, start.
• CAB or archive containing 15+ files with meaningless names (e.g., Amazing.potm, Bee, Ceo.potm, Concentrate) and no obvious structure.
• Fragment files containing partial MZ headers or PE sections when viewed individually.

Implementation Patterns Observed

In sample 7aed04ab, the batch script (Debut, 24,750 bytes) defines 383 variables. Key variables map to:

• Shade → s, Infrastructure → e, Button → t, etc.
• Assembled commands: set Declined=%TEMP%\445107, md %Declined%, set qIiCCSfjONOkaFrioptt=Tragedy.exe, copy /b /y %Declined%\%qIiCCSfjONOkaFrioptt% + Bee + Rh.potm + ...

The payload is split across 19 CAB fragments. Each fragment is individually opaque to file and strings because it is a partial PE or raw data.

Reproduce on Your Own VMs

1. Split a PE into N fragments: split -b 64k payload.exe fragment_
2. Name fragments meaninglessly (e.g., Alpha.potm, Beta, Gamma.txt).
3. Write a batch script:

   @echo off
   set A=s
   set B=e
   set C=t
   ...
   %A%%B%%C% Declined=%TEMP%\testdir
   md %Declined%
   copy /b /y fragment_00 + fragment_01 + ... %Declined%\rebuilt.exe
   start %Declined%\rebuilt.exe
   

4. Pack into a CAB with makecab or 7z.
5. Replace the .rsrc/CABINET resource of a signed wextract.exe.
6. Verify that capa flags the sample as an installer, and osslsigncode verify still passes.

Defensive Countermeasures

• EDR: Flag cmd.exe spawned by wextract.exe with command lines containing >20 %VAR% tokens.
• Sandbox: When extracting CAB contents, look for batch scripts alongside PE fragments. A batch script with hundreds of SET lines is a strong signal.
• YARA: See rule in 54e64e analysis 7aed04ab.

Pages Where Observed

• 54e64e — signed IExpress SFX variant with AutoIt3 payload
• /intel/analyses/7aed04abf7cc42695481b89e4db2e8760eb56dd0fafc7da9f13a43c1158efc5e.html

References

• 7aed04ab batch reconstruction: ^[/intel/analyses/7aed04abf7cc42695481b89e4db2e8760eb56dd0fafc7da9f13a43c1158efc5e.html]