JS Noise-Payload Reassignment Eval

What It Does

A hand-rolled JavaScript/JScript obfuscation technique that hides a real payload inside a massive repetitive noise string, then extracts it via sequential variable-reassignment statements and executes it via the Function constructor. The noise string is a fixed-length base pattern (2,000–3,000 bytes) repeated dozens or hundreds of times with small random insertions between repetitions. The extraction layer uses a target variable (e.g., yielding=[];) followed by N statements of the form target['key']='char';, where each statement adds one character to the payload. The final payload is passed to Function(''+target['key1']+target['key2']+...+ '',0,false).

Detection / Fingerprint

• File size: Typically 500 KB–2 MB for a script file (legitimate JS files >1 MB are rare).
• Single very long line: file utility reports "ASCII text, with very long lines (65536), with no line terminators".
• Repetitive base noise string: A 2,000–3,000 byte alphabetic string appears 50–200 times. This is the strongest clustering fingerprint.
• Sequential property assignments: A variable is declared as an empty array/object, then dozens of var['key']='char'; statements follow.
• Single Function keyword: Only one Function call in the entire file, near the end, with a string argument.
• No commercial obfuscator signatures: No base64 decoder, no charCodeAt/fromCharCode dispatcher, no control-flow flattening.

Implementation Patterns Observed

Noise-Payload Reassignment Pattern (first observed)

Sample c83b7d57 uses a 2,411-byte base noise string repeated 196 times with random insertions, 62 sequential yielding['key']='char'; assignments, and a single Function constructor call. The extracted payload is 62 characters — a base64-like string encoding the real dropper logic. ^[/intel/analyses/c83b7d57a3f534ffd3ac6a8765c99fe1072f6615baf37542c12bb273681ccc91.html]

Comparison to Related Techniques

Reproduce on Your Own VMs

1. Generate a 2,500-byte random lowercase string as the base noise.
2. Base64-encode your real JScript payload.
3. For each character in the base64 string, generate a random 50–120 character key.
4. Build the carrier:

   <noise_string><random_insertion_1><noise_string>...
   yielding=[];
   yielding['key1']='c1';
   yielding['key2']='c2';
   ...
   Function(''+yielding['key1']+yielding['key2']+...+ '',0,false);
   

5. Intersperse noise between each assignment.
6. Save as .js and run through your static pipeline. Verify file reports "very long lines" and strings shows only noise.

Defensive Countermeasures

• Size heuristic: Alert on script files >500 KB.
• Repetition detection: Compute LZ77 compression ratio or use ssdeep — high repetition produces low-complexity hashes.
• Regex for yielding=[]; or similar patterns: Search for \w+\s*=\s*\[\]\s*; followed by repeated \w+\['[^']+'\]\s*=\s*'.'\s*;.
• Monitor WScript/CScript execution: Any .js file >500 KB spawning powershell.exe or cmd.exe is suspicious.

Pages Where Observed

• unclassified-js-noise-base64-eval-dropper — Sample c83b7d57 (first observed)