JS Control-Flow Flattening + String-Array Obfuscation

A JavaScript obfuscation pattern produced by the javascript-obfuscator npm package (or compatible tooling), observed in JScript/WScript droppers targeting Windows. Combines three anti-static techniques in a single pipeline.

How It Works

1. String-array extraction: All literal strings are hoisted into a single array function (_0x3971() returning ['string1', 'string2', ...]). Each string is referenced by numeric index via a dispatcher (_0x2c15(0xXXX)).
2. Array rotation: An IIFE (function(arr, rot){ ... while/shuffle ... }(arr, <expr>)) rotates the array in-place before any lookups occur. The rotation offset is typically a large hex expression evaluated at runtime. Without executing the IIFE, static deobfuscation fails because every index is off by the rotation amount.
3. Control-flow flattening: Every function body is replaced by a single while (!![]) loop containing a switch (_0xpc[_0xpc++]) dispatcher. Original basic blocks become case 'N': labels. The dispatch order is a permutation of integers encoded as a pipe-delimited string (e.g., "5|6|3|2|1|4|0"). Program-counter increments are wrapped in dead arithmetic (0x37*-0x94+-0x173b+0x3707 = 0).

Detection / Fingerprint

• Function bodies that are entirely while (!![]) + switch() with single-character case labels
• Pipe-delimited integer strings split on '|' to drive a dispatcher
• String lookups via alias(0xNNN) where NNN > array length (requires rotation offset)
• Massive /*noise*/ comment blocks between every token (optional but common in malware repackaging)
• Absence of charCodeAt/fromCharCode dispatchers (differentiates from some custom obfuscators)

Defensive Countermeasures

• Behavioural detection: wscript.exe spawning network connections to paste services (rentry.co, pastebin.com) or DuckDNS subdomains is the reliable kill chain regardless of obfuscation.
• Static extraction: Execute the rotation IIFE in a JS engine (Node.js) to recover the rotated array, then replace all alias(0xXXX) calls with resolved strings.
• Block wscript.exe execution of untrusted .js files via AppLocker / WDAC.

Pages Where Observed

• unclassified-js-rentry-telegram-dropper — b0c43e946344 (single sample, this analysis)
• unclassified-js-pptx-dropper — related JScript family using javascript-obfuscator RC4 string-array variant