MalwareINFO Pro Walkthrough Traces Obfuscated JSE and PowerShell Payloads

Summary

A MalwareINFO Pro walkthrough traces an obfuscated JSE and encrypted PowerShell wrapper through recovered source, embedded PE files, and configured endpoint candidates, while distinguishing recovered artifacts from unobserved runtime behavior.

Key points

• The Analyzer processes the files locally without running scripts, loading recovered binaries, or contacting infrastructure.
• For the JSE, it identifies a string-table lookup with custom Base64 and UTF-8 handling and an RC4-style decoder; 30 expression edits were proven, while receiver identity and dispatch remained unknown.
• The JSE references a PowerShell URL at eight source locations and includes XMLHTTP and WScript.Shell references, but whether those operations occurred at runtime is unconfirmed.
• The PowerShell wrapper's Base64 data was decrypted with AES-CBC and decompressed with GZip; the recovered source matched the wrapper's declared SHA-256.
• Analysis recovered a 48,128-byte artifact through Base64 and repeating-key XOR transformations, plus a separate 525,312-byte embedded PE. A successful load or invocation was not observed.
• The PE configuration contained two endpoint candidates, speed1989[.]duckdns[.]org:1926 and speed11989[.]duckdns[.]org:1926, marked ConfiguredNotObserved; no network activity was collected.
• The reports did not establish a byte-for-byte link between the JSE and PowerShell samples.

Indicators of compromise

MITRE ATT&CK

Products