How Nefilim Dropper uses Polymorphism

The talk examines a Nefilim malware dropper written in VBScript. The script hides its payload in large arrays of numbers and buries the code under many comments, so it looks harmless at first glance. The speaker strips out the noise, separates the data assignments from the logic, and finds the decoder function that turns those arrays back into a portable executable.

The decoder includes a random step applied at a few fixed positions, so each run writes a file with a different hash while the behaviour stays the same. The speaker estimates how many distinct variants are possible and shows that the import hash stays constant across the dropped samples, which makes it a more durable pivot than the file hash. The rest of the script is reviewed as well: checks for disk size, core count, memory and running analysis tools, a marker file used to avoid reinfection, a fake error message, and a rundll32 launch of the dropped DLL.

For incident responders, the talk points to the dropped DLL, the marker file and rundll32 executing unusual files from temp. Detection teams are encouraged to look at script-driven process ancestry and WMI queries used for environment checks. The behaviour is mapped to ATT&CK techniques such as user execution, WMI and signed binary proxy execution. The takeaway is that blocking by known hash alone misses this kind of polymorphic dropper.