js-custom-noise-obfuscation

Custom JavaScript obfuscation technique characterised by embedding the real payload at the end of a massive noise block, then wrapping meaningful strings in a split-string array with comma-separated character blocks. Used in commodity JScript droppers to defeat naive string extraction and inflate file size.

What It Is

Unlike commercial tools like javascript-obfuscator, this is hand-rolled obfuscation. The carrier .js file is padded with repetitive Unicode noise (CJK characters, emoji chains, and repeated marker tokens like HYXWKUKKGOMTODEC) so that the real payload line sits at a high byte offset, beyond casual inspection. The payload itself uses:

1. Noise padding — Megabytes of Unicode filler before the transition marker ";var HYXWKUKKGOMTODECI=
2. Split-string array — A 300–400 element array where each literal is broken into comma-separated character fragments (e.g., 'S,cr,ip,ti,ng.,Fi,le,Sy,ste,mO,bje,ct')
3. Dead-code arithmetic — Every meaningful call is wrapped in hex arithmetic (0x4d*-0xb+0xc6d+-0x91d) that collapses to a constant index at runtime
4. IIFE chaining — Nested immediately-invoked function expressions with randomized _0x variable names

Detection / Fingerprint

Look for:

• Very large .js files (2–5 MB) with very low logical line counts (<100)
• Repeated Unicode blocks and marker tokens in the first 50–100 KB
• A single long line after a ";var <MARKER>= transition
• Comma-split string literals inside an array declaration
• Absence of javascript-obfuscator signatures (no base64 decoder, no charCodeAt/fromCharCode dispatcher, no self-defend trap)

Defensive Countermeasures

• Size heuristics: legitimate JS files >1 MB are rare
• Regex for \x5c (backslash escape) inside split strings to recover Windows paths early
• Monitor WScript/CScript spawning cmd.exe /c schtasks or writing to C:\Users\Public\

Pages where observed

• unclassified-js-dropper — Sample 404356dbc85c ^[/intel/analyses/404356dbc85ca00d7d25974a4b7d6bab219b166c060b4d51dd0a34c0cf2b0eeb.html]