> Technique · JScript Hex+ROT WMI Reflective Dropper_

~/packetpursuit $ cat /intel/techniques/jscript-hexrot-wmi-reflective-dropper.md

typetechniqueconfidencemediumcreated2026-06-12updated2026-06-12jscriptobfuscationwmipowershellreflective-loader

JScript Hex+ROT WMI Reflective Dropper

A three-stage JScript obfuscation pipeline followed by WMI hidden-process creation and a PowerShell reflective .NET assembly loader. Observed in Polish-language purchase-order spam lures.

Pipeline

Stage 1 — Unicode fragment assembly (luminal)

The script defines luminal(picture, beefsteak, retaping) as:

function luminal(picture, beefsteak, retaping){
    return beefsteak + picture.slice(1) + retaping;
}

Readable strings are split across three arguments and appended to this.bucorvus across thousands of repetitions. Each call is trivial individually, but the volume (~27,600 calls in a 2.3 MB file) exhausts manual review and naive string extraction. ^[/intel/analyses/a94a77a31e66e7c54af6a47a0a2f2b1f6cb35f2232f466d92d2dc8546d4130ed.html]

Stage 2 — Hex decoding

After the luminal stage, the script evaluates the assembled string, which contains arrays (beild, piminodine, etc.) encoded as continuous hex. Decoded with:

roadmaker = roadmaker + String.fromCharCode(parseInt(directions.substr(doggiest, 2), 16));

Stage 3 — ROT13 substitution

Uppercase and lowercase alphabetic characters are rotated 13 positions:

// uppercase
aires = aires + String.fromCharCode(((symcentry - 65 + 13) % 26) + 65);
// lowercase
aires = aires + String.fromCharCode(((symcentry - 97 + 13) % 26) + 97);

Stage 4 — WMI hidden-process spawn

The decoded payload instantiates ActiveXObject("WScript.Shell"), sets an environment variable, and spawns the process via:

var aleuronaplasts = new ActiveXObject("WScript.Shell");
// ...
aleuronaplasts.ShowWindow = 0;
// Win32_Process.Create invoked

Stage 5 — PowerShell reflective .NET loader

The spawned process runs PowerShell that:

  1. Builds a download URL (obfuscated with .Replace('#','s'))
  2. Creates Net.WebClient
  3. Calls .DownloadData()
  4. Loads the assembly with [Reflection.Assembly]::Load
  5. Invokes Fiber.Program::Main() via reflection

No second-stage file touches disk. ^[/intel/analyses/a94a77a31e66e7c54af6a47a0a2f2b1f6cb35f2232f466d92d2dc8546d4130ed.html]

Detection / Triage

  • File is plain UTF-8 text (CSV Unicode text, UTF-8 text per file) — binary sandboxes (CAPE, capa, floss) will skip or fail.
  • grep -c "this.bucorvus += luminal(" returns thousands — immediate red flag.
  • grep -E "ActiveXObject|Win32_Process|ShowWindow" in the same file confirms execution intent.
  • For deobfuscation: strip the luminal noise, evaluate the remaining JS in a safe environment, then run the hex+ROT13 loop on the extracted arrays.

Related