ANY.RUN<p>🚨 Control-Flow Flattening Obfuscated <a href="https://infosec.exchange/tags/JavaScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>JavaScript</span></a> Drops <a href="https://infosec.exchange/tags/Remcos" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Remcos</span></a>.<br>⚠️ The observed JS contains multiple self-invoking functions that loop arrays of strings and numbers in a while(!![]) loop until a calculated checksum matches a predefined value. This <a href="https://infosec.exchange/tags/obfuscation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>obfuscation</span></a> technique forces static analyzers to parse through the array content instead of returning the required string directly. </p><p>🎯 <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ANYRUN</span></a>’s Script Tracer enables easy analysis of heavily obfuscated scripts by logging their execution in real time, with no need for manual deobfuscation. </p><p> 🔗 Execution chain:<br><a href="https://infosec.exchange/tags/Wscript" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Wscript</span></a> (JavaScript) ➡️ PowerShell ➡️ MSBuild (Remcos 🚨) </p><p>👨💻 See analysis session: <a href="https://app.any.run/tasks/eaef10ea-3567-4284-b87e-a3a0aedc5f83/?utm_source=mastodon&utm_medium=post&utm_campaign=obfuscated_js_drops_remcos&utm_term=110625&utm_content=linktoservice" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">app.any.run/tasks/eaef10ea-356</span><span class="invisible">7-4284-b87e-a3a0aedc5f83/?utm_source=mastodon&utm_medium=post&utm_campaign=obfuscated_js_drops_remcos&utm_term=110625&utm_content=linktoservice</span></a></p><p>This script invokes <a href="https://infosec.exchange/tags/PowerShell" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PowerShell</span></a> using ActiveXObject("<a href="http://WScript.Shell" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">http://</span><span class="">WScript.Shell</span><span class="invisible"></span></a>") with parameters and executes the following: <br>🔹 Creates a <a href="http://System.Net" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">http://</span><span class="">System.Net</span><span class="invisible"></span></a>.WebClient object <br>🔹 Specifies the URL to download the binary <br>🔹 Downloads the binary data and passes it to <a href="https://infosec.exchange/tags/MSBuild" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MSBuild</span></a> </p><p> ⚠️ As a result, the script downloads and executes the Remcos <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> module. </p><p>👨💻 Observe obfuscated loaders, explore execution flows, and extract behavioral indicators in real time. Improve your security operations with <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ANYRUN</span></a> Sandbox.</p>