Function Return-This Global Construction

What It Does

A JavaScript obfuscation technique used in Windows Script Host (WSH) environments to access the global WScript object without hardcoding its name. The idiom Function('return this')() constructs an anonymous function whose body is the literal string 'return this', then immediately invokes it. Inside a WSH context, this resolves to the global object, which exposes WScript, ActiveXObject, and other host APIs.

This technique defeats naive static string matching because the literal WScript never appears in the source code — it is assembled at runtime via bracket-property access on the global object.

Detection / Fingerprint

• Look for Function('return this')() or Function('return this')()['WScript'] in JScript/VBScript droppers.
• The pattern is often chained: Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](...).
• May be combined with dictionary lookup-table obfuscation: dictionary keys assemble the string 'return this' character by character.
• Commonly appears inside try/catch decoy blocks where the catch handler is the only real code path.

Implementation Patterns Observed

Direct global-object construction

Observed in e6ebae6a (third sibling): ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]

Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](...)

Dictionary-assembled global-object construction

Observed in 6f72a3a9 (forty-third sibling): ^[/intel/analyses/6f72a3a915d69e757c8a7114f42c28ad6f8fdc6e96b5ccffa078c39e4df6643a.html]

Function(''+hovertastefulconnection['surroundsedateinsect']+hovertastefulconnection['gazeshadeblind']+...+'')()
  [''+hovertastefulconnection['guessdecorousgoofy']+...+'']
  [''+hovertastefulconnection['staydeerhateful']+...+'']
  (''+hovertastefulconnection['guessdecorousgoofy']+...+'')

Each bracket lookup resolves to a single character; the assembled string 'return this' is passed to Function(), which returns the global object when invoked. The chain then accesses ['WScript'], ['CreateObject'], ['WScript.Shell'], and finally ['run'] with the payload command.

Reproduce on Your Own VMs

Create a local .js file with:

var global = Function('return this')();
WScript.Echo(global === WScript);  // true in WSH

Run with cscript //nologo test.js. The Function constructor evaluates the string argument in the global scope, returning the host's root object.

For an obfuscated variant:

var d = {};
d['a']='r'; d['b']='e'; d['c']='t'; d['e']='u'; d['f']='r'; d['g']='n'; d['h']=' ';
d['i']='t'; d['j']='h'; d['k']='i'; d['l']='s';
var cmd = d['a']+d['b']+d['c']+d['h']+d['i']+d['j']+d['k']+d['l'];
var global = Function(cmd)();
global['WScript']['Echo']("It works");

This demonstrates the same assembly pattern used by the malware family.

Defensive Countermeasures

• Process telemetry: Alert on wscript.exe or cscript.exe spawning powershell.exe with -EncodedCommand.
• Script content inspection: Block .js attachments that contain Function('return this') or DavWWWRoot in the same file.
• Network: Block outbound HTTP on port 8888 to known WebDAV infrastructure (dailywebstats.com, cloudslimit.com, 45.9.74.x).

Pages Where Observed

• unclassified-js-webdav-dropper entity page — family overview
• e6ebae6a — direct Function('return this')() variant ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
• df42ecf8 — dictionary-assembled variant ^[/intel/analyses/df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87.html]
• 6b7435afd70e — dictionary-assembled variant ^[/intel/analyses/6b7435afd70e75ca5278e20f018ab17768b7b3be26c31dfbbc9d927dc455f2e2.html]
• 6f72a3a9 — dictionary-assembled variant with nested try/catch ^[/intel/analyses/6f72a3a915d69e757c8a7114f42c28ad6f8fdc6e96b5ccffa078c39e4df6643a.html]
• 33c0bfaf — dictionary-assembled variant with nested try/catch, tworemindgentle object, cloudslimit.com:8888 C2 ^[/intel/analyses/33c0bfaf30f6bf50b1a7d4315702f2bc88f5f252945ab34dd1e26111b7b73ff8.html]
• d53e312c — dictionary-assembled variant (62-entry noise-key, 1,255-char variable name), 94.159.113.79:8888 C2, 1155205305919.dll payload, regsvr32 /s execution, no PowerShell wrapper. ^[/intel/analyses/d53e312cb610888ea40512afb07b56ab114fb4c3225d7efce6863eea65d93148.html]