js-fixed-delimiter-concat-obfuscation

JScript anti-static technique: split payload across hundreds of += string-concatenation lines, interleaving a fixed noise token between every payload character. The noise token is stripped at runtime via String.replace(regex, "") before the payload is executed.

What It Does

This technique defeats naive string extraction by ensuring no contiguous substring of the real payload exists in the source file. Every character of the payload is separated by a fixed multi-character token (e.g., bngbimfrhIbkmi, 13 chars). The resulting source file contains ~1,500 lines of Fbpamhie += "..." statements, each line containing a fragment of the payload plus repeated noise tokens.

Detection / Fingerprint

• Source files with >500 lines of varname += "...";
• Repeated occurrence of a fixed token (e.g., bngbimfrhIbkmi) across the majority of lines
• Final line performing replace(/token/g, "") on the accumulated string
• Often followed by GetObject("winmgmts:...") or WScript.Shell execution

Implementation Patterns Observed

var Fbpamhie = "pobngbimfrhIbkmiwerbngbimfrh";
Fbpamhie += "IbkmishbngbimfrhIbkmiellbngb";
// ... 1,530 more lines ...
Fbpamhie = Fbpamhie.replace(/bngbimfrhIbkmi/g, "");

In sample 56ea37ef, the cleaned string reveals a PowerShell command with an embedded Base64 blob, a character-substitution step (f# → r), and a UTF-16 LE decode chain. ^[/intel/analyses/56ea37ef9e4ae2bb4d0e11b84ba3aea650a55018cd3430d6c75f0a5ef6815d81.html]

Reproduce on Your Own VMs

// obfuscator.js — replicate the technique
const fs = require('fs');
const payload = "WScript.Echo('Hello, world!');";
const token = "bngbimfrhIbkmi";
const lines = [];

for (let i = 0; i < payload.length; i += 20) {
  let chunk = "";
  for (let j = i; j < Math.min(i + 20, payload.length); j++) {
    chunk += payload[j] + token;
  }
  lines.push(`Fbpamhie += "${chunk}";`);
}

const output = `var Fbpamhie = "";\n${lines.join("\n")}\nFbpamhie = Fbpamhie.replace(/${token}/g, "");\neval(Fbpamhie);`;
fs.writeFileSync("output.js", output);

Defensive Countermeasures

• Static analysis tools should tokenize and search for high-frequency repeated substrings inside JavaScript string literals
• Behavioral detection: scripts with >500 += string-append operations on the same variable within a short span
• YARA rule targeting replace(/noise_token/g, "") after massive concatenation blocks

Pages Where Observed

• unclassified-js-bitbucket-stego-dropper — 56ea37ef sample