Delphos Lantern scores #1 on BinaryAudit backdoor detection: by mean, peak, floor, and reproducibilityLearn more
Loader

JScript downloader analysis: Korean "fitness assignment" cover story hides a download, unzip, and execute chain

Defense evasionExecution

Script · Oct 8, 2026

Verdict:Malicious
Confidence:High

Conclusion

The submitted artifact set is an obfuscated Windows Script Host JScript downloader/dropper. The extracted script uses WScript and multiple ActiveXObject components to download remote content, save it to disk, extract a ZIP archive into a local directory, write an additional decoded blob to disk, and finally execute a built command or payload with WScript.Shell.Run. The script is disguised with a misleading Korean “fitness tool / university assignment” comment block that does not match its behavior.
Immediate safety implication: treat the sample as an active staging mechanism for additional payload delivery and execution on Windows hosts.

Scope and Coverage

Uploaded roots

  • 36bcadfb4ec48f22b12f034a5d3567f976860c4dc7f970514a958f0030992e56.zip — AES-encrypted ZIP per metadata.

Important children

  • extracted/36bcadfb4ec48f22b12f034a5d3567f976860c4dc7f970514a958f0030992e56-8d28f0/36bcadfb4ec48f22b12f034a5d3567f976860c4dc7f970514a958f0030992e56.js — only extracted behavior-bearing child.
  • Derived review copy: analysis/javascript/extracted/.../36bcadfb4ec48f22b12f034a5d3567f976860c4dc7f970514a958f0030992e56.beautified.js.

Coverage performed

  • Inventory of prepared extraction contents.
  • Static review of the original and beautified JavaScript.
  • Regex/string searches for network, filesystem, script-host, and execution primitives.
  • Manual inspection of the downloader, unzip, file-write, and execution regions.

Limitations

  • Automatic JavaScript deobfuscation failed on the sample, so some runtime-decoded strings were not fully recovered.
  • The exact remote URL and exact executed command/payload path remained obfuscated in the reviewed output.
  • No dynamic execution was performed; conclusions are based on static, code-backed behavior.

Artifact Relationships and Behavioral Sequence

  1. The ZIP yields one obfuscated JavaScript file.
  1. That script runs under Windows Script Host, not in a browser or benign web context.
  1. It downloads remote content to a local path.
  1. It extracts a ZIP archive into a destination directory and deletes the source archive.
  1. It separately writes a large decoded blob to disk via a stream object.
  1. It invokes Run(...) through a WScript.Shelllike object to execute a resulting command or payload.
This establishes a parent-child staging chain: the root ZIP delivers the obfuscated JScript, and the JScript in turn retrieves, writes, unpacks, and launches additional content.

Key Findings

1. The script is Windows malware-style JScript, not a fitness assignment

The header comment claims a university fitness project, but the actual code uses Windows Script Host and COM automation:
  • analysis/javascript/...beautified.js:4558-4559 creates an ActiveXObject(...) into myObject.
  • analysis/javascript/...beautified.js:4674 references WScript.
  • analysis/javascript/...beautified.js:4740-4763 constructs the string for Scripting.FileSystemObject and instantiates it at :4785.
Why it matters: these are host-automation primitives used for local file and process control, not for a benign academic fitness utility. The mismatch between comment and code is deceptive.

2. Reachable downloader writes HTTP response data to disk

A function named downloadAndSave(...) is defined and contains a synchronous HTTP download and file-save flow:
  • Function definition at analysis/javascript/...beautified.js:8000.
  • Opens an HTTP request with GET at :8081.
  • Sends the request at :8046.
  • Checks for HTTP 200 at :8047.
  • Pulls the response body and writes it through a stream object at :8053-8066.
  • Creates destination folders if needed at :8096-8097.
The function is not dead code; it is invoked later:
  • analysis/javascript/...beautified.js:8984 calls downloadAndSave(GTREYRTY, WYEOCOCAABLOPFIYUX + ...).
Why it matters: this is direct evidence of remote payload retrieval and local staging.

3. The script unpacks a downloaded ZIP archive into the local filesystem

ZIP staging is supported by both string evidence and code flow:
  • String extraction found \TRUE.zip in the sample.
  • analysis/javascript/...beautified.js:8986 defines unzipAndDelete(...).
  • analysis/javascript/...beautified.js:8995-9004 creates filesystem/archive-related COM objects and ensures the destination folder exists.
  • analysis/javascript/...beautified.js:9027-9040 copies archive contents into the destination and loops with WScript.Sleep(...) while extraction completes.
  • analysis/javascript/...beautified.js:9959 invokes unzipAndDelete(WYEOCOCAABLOPFIYUX + ..., WYEOCOCAABLOPFIYUX).
Why it matters: the sample is not just downloading a file; it is unpacking staged content for later use, which is typical dropper behavior.

4. A separate decoded blob is written to disk with SaveToFile

A later block creates another COM/stream object and writes a large decoded blob to disk:
  • analysis/javascript/...beautified.js:10848-10850 creates an ActiveXObject(...) for a stream-like object.
  • analysis/javascript/...beautified.js:10979-11002 writes content and calls SaveToFile(...).
Why it matters: this indicates an additional embedded or transformed payload is materialized locally, beyond the network-downloaded archive.

5. Final payload execution is explicitly present and reachable

The script obtains a shell object and calls Run(...):
  • analysis/javascript/...beautified.js:11047 obtains a WScript shell-related object.
  • analysis/javascript/...beautified.js:11135 constructs the command/path variable WYEOCOCAABLOPFIYYYU.
  • analysis/javascript/...beautified.js:11158 executes WYEOCOCAABLOPFIYIVV['Run'](WYEOCOCAABLOPFIYYYU, ..., ![]).
Why it matters: this is the transition from staging to execution. It confirms the script is intended to launch a payload or command on the victim system.

Alternative Explanations and Contrary Evidence

Strongest alternative

A possible alternative is that this is a legitimate obfuscated installer or updater that downloads and unpacks application files.

Evidence against that alternative

  • The visible cover story is a “fitness tool / university assignment,” which does not align with Windows Script Host + COM automation + downloader + unzip + execute behavior.
  • The code is heavily obfuscated and uses deceptive comments instead of transparent installer logic.
  • The workflow includes remote retrieval, archive extraction, secondary blob writing, and shell execution, all typical of malware droppers.
  • No benign application metadata, installer branding, or user-facing installation flow was identified in the extracted set.
Given the combination of deception and staged execution behavior, the benign-installer explanation is materially weaker than the malicious-dropper explanation.

Unknowns

  • Exact remote URL/source: not recovered from the static beautified view because the dedicated deobfuscation step failed.
  • Exact final command or child binary path: execution via Run(...) is confirmed, but the resolved string passed to Run remained obfuscated.
  • Nature of the final payload: the sample clearly stages and executes follow-on content, but the child payload itself was not separately recovered in this session.
These unknowns do not block classification because the malicious staging and execution behavior is directly evidenced in the script.

Verdict Rationale

The verdict is malicious because the artifact set contains a deceptive, obfuscated WSH JScript that performs a complete dropper chain: remote download, local file creation, ZIP extraction, additional payload writing, and execution. These are direct, code-backed behaviors in the only extracted child artifact, and they are incompatible with the claimed benign purpose in the file header. While some strings remain obfuscated, the unresolved URL and final command are details of implementation, not uncertainty about class or intent.

About Delphos Labs Analysis

The Delphos platform analyzes compiled binaries directly and produces structured behavioral intelligence reports within minutes. This lets analysts understand what a binary does without manual analysis.

Request Access
Back to all reports