> Technique · JS Dictionary Character Lookup Obfuscation_

~/packetpursuit $ cat /intel/techniques/js-dictionary-char-lookup-obfuscation.md

typetechniqueconfidencehighcreated2026-06-24updated2026-07-18obfuscationscriptdefense-evasionevasion

JS Dictionary Character Lookup Obfuscation

What It Does

A JavaScript obfuscation technique that maps a large set of natural-language keys (typically English words or phrases) to single ASCII characters, then assembles the real payload at runtime by concatenating dictionary lookups. The dictionary is built inside a try/catch block or IIFE, and the string assembly uses Function('return this')() to access the global WScript object in Windows Script Host (WSH) environments.

This technique defeats naive static string matching because no meaningful character sequence appears in the source — only the dictionary keys, which are chosen to look like random noise or legitimate prose.

Detection / Fingerprint

  • Script file contains a large object literal (36–100 entries) mapping unusual keys to single-character values.
  • Keys are natural-language phrases — three-word English alliterative phrases (wide-eyedquickbrass), two-word compound phrases (advertisementwingreaction), or random noise strings.
  • No meaningful API names in source — WScript, Shell, Run, powershell, regsvr32 appear only as concatenated dictionary lookups at runtime.
  • Function('return this')() construction — used to access the global object (WScript in WSH) without hardcoding the name.

Implementation Patterns Observed

Dictionary-Assembly Pattern (36-entry and 62-entry variants)

Observed across the unclassified-js-webdav-dropper cluster. The 36-entry variants use shorter, often random noise keys, while the 62-entry variants use longer natural-language or noise keys. ^[/intel/analyses/41d04ad5999555d632e0fdf4cd1aba63bc4d4abe319ef699c6b4a09219b7b40a.html]

Key Naming Conventions

Sample Key Style Count Example Keys
ccb2d007 Alliterative three-word phrases 62 wide-eyedquickbrass, campturkeydonkey
cc90d6c Alliterative three-word phrases 62 wholesaleentergullible, transportairbillowy
fb353965 Random English word pairs 62 flippantcleverspare, competitioncrackercoast
df42ecf8 Random noise strings 62 hrwfkasmlfbj, wsvyrgxfayjk, vfnmkhfojmppibtgr
e6ebae6a Short word pairs 36 (unknown; earlier dictionary variant)
fa7e181d Short word pairs 36 (unknown; dictionary variant)
d0124d62 Random noise strings 36 nxjvhshp, wuercfhqseamqzuu
d90baa30 Random noise strings 36 oagtwglybkhkruc, fuatuxnzrflvnfmvmpd
a435a37b Random noise strings 36 mcresythfgmletv, tvlqlesrxsaw, inubkcqhhizythkiqv
aac0198b5 Natural-language compound phrases 62 erectaverageavoid, destructionthunderrainstorm, flagrebelplan
a3419c27a Natural-language compound phrases 62 saltwhiteclean, bashfulyellowe, sheeptoothbrushring
be58d381 Random noise strings 36 psdm, bdquzghaaofnpisnloo, pgzeswvjlefwlob
92ce4217 Random noise strings 36 fcyszym, bgmnvcsutppyfwy, szpasrpodwoxtgocidt
94686f16 Natural-language three-word compound phrases 62 pocketoverratedshiny, gutturalalivegrade, victoriousworryfilm (object)
69f29779 Natural-language compound phrases 62 agreeluxuriantpolitical (object), fallaciousinterestingclam, flippantexplodevivacious
6b7435afd70e Random noise strings 62 aaucxocqrqtxmcvuir, fciiljesabbnnfozorr, mrmuntdsadqdlocoqr
6d9546a6 Non-alliterative three-word compound phrases 62 ironfanaticalmuscle, faithfulequablebushes, wonderdamawake (object: ruthlesssoreeyes)
6f1d7c74 Shared-prefix batch/JS dual-layer 62 edlcdp prefix for both batch SET and JScript dictionary keys (polyglot variant)
385c2f05 Random noise strings 62 qasxhtigcgmdn, awcic, livarqlwafzir, nhwaliezihukwyno
41d04ad5 Random noise strings 36 ilsqdjmcpvjw (object), uxmgkrrlgwlfspsn, bppfjnsshbqhiepxnb, dtkxzvjxczhkdvyj
438fce55 Random noise strings 36 wloiyndlclbycxtcnr (object), cjrjfenzabxydkdhmyd, jijqhnkjtwnvbdlovhx, dtbjesemvozaa
f8dce7df Random noise strings (extreme padding) 62 2,478-char variable name, 50-200 char keys
fbdd83ad Random noise strings 100 fwzwiqux (object), rxfyqcbgph, pbtldgimvaw, lhxocnfwqj
093a56f6 Random noise strings 62
0e45e1b2 Random noise strings
c4670e86 Random noise strings 100
e2568b43 Random noise strings 100

The dictionary size (36, 62, or 100) and key naming style are the primary observable deltas between builds.

Reproduce on Your Own VMs

  1. Build the dictionary. Pick 62 unique English phrases and map to [a-zA-Z0-9] plus common symbols.
  2. Encode your payload. Split a PowerShell or JScript command into character-by-character lookups.
  3. Wrap in decoy. Use try{undefinedFunction();}catch(e){...} to force the catch path.
  4. Test against EDR. Run through Windows Defender or your EDR's script engine. Static string detection will fail; behavioral detection (monitoring WScript.Shell.Run) will catch it.

|- a435a37b analysis — 36-entry noise-key dictionary variant (mcresythfgmletv object), WebDAV C2 45.9.74.36:8888, 8219187519655.dll payload. Third noise-key variant in family. ^[/intel/analyses/a435a37bb42d4d9d60eeec11ed434a8f053bd364cbb04e212a8f10085477ad07.html]

|- be58d381 analysis — 36-entry noise-key dictionary variant (iysqohpjciwm object), WebDAV C2 45.9.74.36:8888, 5047102111834.dll payload. Ninth 36-entry noise-key variant on this infrastructure. ^[/intel/analyses/be58d381d9e917fe99ea9d0f87f27a81d80ef8f10e6b126d021f3d2684246664.html]

|- 6d9546a6 analysis — 62-entry non-alliterative three-word compound-phrase dictionary variant (ruthlesssoreeyes object), WebDAV C2 cloudslimit.com:8888, 48271327530129.dll payload. Fortieth confirmed sibling in family; sixth distinct 62-entry dictionary key-naming dialect. Static-only. ^[/intel/analyses/6d9546a642119939153c1d31eba6f20b724b80a6893e44fd4b894a1656762163.html]

|- 69f29779 analysis — 62-entry natural-language compound-phrase dictionary variant (agreeluxuriantpolitical object), WebDAV C2 cloudslimit.com:8888, 94001122714432.dll payload. Thirty-eighth confirmed sibling; fourth natural-language compound-phrase variant on cloudslimit.com infrastructure. ^[/intel/analyses/69f297794c23d603d869d588404ef7f93f9a525be50a7029fe0b1c61a329de38.html]

|- 92ce4217 analysis — 36-entry noise-key dictionary variant (fcyszym object), WebDAV C2 45.9.74.36:8888, 88503242411784.dll payload. Tenth 36-entry noise-key variant on this infrastructure. Static-only. ^[/intel/analyses/92ce4217922acf56056745b6166725d5c01707658501873b2253d482a9db6481.html]

  • ade6cf68 analysis — 36-entry noise-key dictionary variant (drqpclrtazhhywz object, 18–20 char keys), WebDAV C2 45.9.74.36:8888, 3118252697895.dll payload. Seventh 36-entry noise-key variant on this infrastructure. ^[/intel/analyses/ade6cf68d1448793cf8a2af4b5d526c53e07f3484265d92e94da856331055451.html]

||- 94686f16 analysis — 62-entry natural-language three-word compound-phrase dictionary variant (victoriousworryfilm object), WebDAV C2 cloudslimit.com:8888, 218791486131743.dll payload. Thirty-third confirmed sibling; third natural-language compound-phrase variant on cloudslimit.com infrastructure. ^[/intel/analyses/94686f16158a32fec0f36ef888a4c20ca423fdd0dfd4992df7d2912befd67001.html]

||- 33c0bfaf analysis — 62-entry natural-language compound-phrase dictionary variant (tworemindgentle object), WebDAV C2 cloudslimit.com:8888, 9962227832088.dll payload. Fifty-fourth confirmed sibling; seventh natural-language compound-phrase variant on cloudslimit.com infrastructure. OpenCTI mislabelled strelastealer. Static-only. ^[/intel/analyses/33c0bfaf30f6bf50b1a7d4315702f2bc88f5f252945ab34dd1e26111b7b73ff8.html]

  • 6f1d7c74 analysis — 62-entry shared-prefix batch/JS dual-layer dictionary (edlcdp prefix), JScript/batch polyglot, WebDAV C2 45.9.74.13:8888, 569.dll payload. Forty-second confirmed sibling; first shared-prefix dual-layer variant in family. ^[/intel/analyses/6f1d7c74e68fc707cf97686965acedd80b8f2e809618589a2a4d4cc0fa08a36c.html]

  • 438fce55 analysis — 36-entry noise-key dictionary variant (wloiyndlclbycxtcnr object), WebDAV C2 45.9.74.36:8888, 128892711629914.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Sixty-second confirmed sibling; thirteenth distinct 36-entry noise-key variant on 45.9.74.36:8888 infrastructure. Static-only. ^[/intel/analyses/438fce55de8d3e949b054332b416c1c910340aeede947279ca3802382aa1d9e3.html]

Defensive Countermeasures

  • Behavioral detection: Monitor wscript.exe spawning powershell.exe or cmd.exe with encoded commands. This is the reliable kill chain regardless of obfuscation.
  • Script-engine logging: Enable Windows Script Host logging (if not disabled) to capture the decoded command before execution.
  • Application control: Block wscript.exe or cscript.exe from executing untrusted .js files via AppLocker/WDAC.

Pages Where Observed

  • unclassified-js-webdav-dropper — entity page for the family that uses this obfuscation
  • ccb2d007 analysis — 62-entry alliterative dictionary, dailywebstats.com:8888 C2 ^[/intel/analyses/ccb2d007b367cbea45bb289fbcb0b01f2ea7aea932118e06d213e36a7b0c2ae9.html]
  • cc90d6c analysis — 62-entry alliterative dictionary, same C2 host, different keys ^[/intel/analyses/cc90d6c54bfdfe7b7bc5ff2a92facb38f599efa43118f47ec09330414c3d0ccf.html]
  • e6ebae6a analysis — 36-entry dictionary variant, dailywebstats.com:8888 C2 ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
  • d0124d62 analysis — 36-entry dictionary variant, random noise key names, 45.9.74.36:8888 C2 ^[/intel/analyses/d0124d62f526f1ba31cd9c13c517e4cf208c5871df148ed35700149918a07e96.html]
  • d90baa30 analysis — 36-entry dictionary variant, random noise key names, 45.9.74.36:8888 C2, 271121311026510.dll payload ^[/intel/analyses/d90baa30d71388a99be3861ac53164533db2ab2de75ff3f9e3a5396f680fc19b.html]
  • df42ecf8 analysis — 62-entry noise-key dictionary variant (galo object), WebDAV C2 cloudslimit.com:8888, 20628311887910.dll payload. First 62-entry noise-key dialect in family. ^[/intel/analyses/df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87.html]
  • a3419c27a analysis — 62-entry natural-language compound-phrase dictionary variant (saltwhiteclean object), WebDAV C2 cloudslimit.com:8888, 81431039211394.dll payload. First natural-language (non-alliterative, non-noise) key style observed on cloudslimit.com infrastructure. ^[/intel/analyses/a3419c27a814123e4576d29186ab985b2c28ef33f3153de6b81eb17b01a09990.html]
  • b612dd70 analysis — 36-entry noise-key dictionary variant (sqsecyprtszemhrr object), WebDAV C2 45.9.74.36:8888, 20371580615655.dll payload. Eighth 36-entry noise-key variant on this infrastructure. ^[/intel/analyses/b612dd701448df367c9c9a6e57894822e3c227af915b93d0eda196118af620ad.html]
  • be58d381 analysis — 36-entry noise-key dictionary variant (iysqohpjciwm object), WebDAV C2 45.9.74.36:8888, 5047102111834.dll payload. Ninth 36-entry noise-key variant on this infrastructure. ^[/intel/analyses/be58d381d9e917fe99ea9d0f87f27a81d80ef8f10e6b126d021f3d2684246664.html]
  • 6f1d7c74 analysis — 62-entry shared-prefix batch/JS dual-layer dictionary (edlcdp prefix), JScript/batch polyglot, WebDAV C2 45.9.74.13:8888, 569.dll payload. Forty-second confirmed sibling; first shared-prefix dual-layer variant in family. ^[/intel/analyses/6f1d7c74e68fc707cf97686965acedd80b8f2e809618589a2a4d4cc0fa08a36c.html] | f8dce7df analysis — 62-entry noise-key dictionary variant with extreme padding (2,478-char variable name), WebDAV C2 94.159.113.82:8888, 13924273943322.dll payload. Sixty-fourth confirmed sibling; sixth 62-entry noise-key variant and first extreme-padding dialect in family. ^[/intel/analyses/f8dce7df01e67193715270902da32b193a7497b5ad82d8e8721516ed6654fd5d.html] || fbdd83ad analysis — 100-entry noise-key dictionary variant (fwzwiqux object), WebDAV C2 94.159.113.84:8888, 317101471316421.dll payload. Sixty-sixth confirmed sibling; largest dictionary observed in family (100 entries vs. prior 62-entry maximum). New C2 IP in the 94.159.113.x subnet. Static-only. ^[/intel/analyses/fbdd83ad649b5e90df9910f67eee3db9502bf63ccc0b958c10d8ade1d839d2f8.html] ||| c4670e86 analysis — 100-entry noise-key dictionary variant (dpnnvyvzadjustment object), WebDAV C2 94.159.113.84:8888, 22598943117575.dll payload. Seventy-sixth confirmed sibling; second 100-entry dictionary variant in family, same C2 IP as fbdd83ad but different payload. No PowerShell wrapper. Static-only. ^[/intel/analyses/c4670e866e87f9e7ffb02554d931363f2bab26f4b312383276fb2b869e0ac843.html] |||| d53e312c analysis — 62-entry noise-key dictionary variant (1,255-character extreme variable-name padding), WebDAV C2 94.159.113.79:8888, 1155205305919.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Seventy-seventh confirmed sibling; third-longest variable name in family. No batch/polyglot layer. Static-only. ^[/intel/analyses/d53e312cb610888ea40512afb07b56ab114fb4c3225d7efce6863eea65d93148.html]