← All detection heuristics · HTML
medium
HTML_OBFUSCATED_STRING_BUILDER
What it means
HTML script repeatedly builds strings from small fragments.
Why it fires
Heavy string-fragment construction hides object names, commands, URLs, and payloads from static scanners and is common in malicious script.
Other HTML heuristics
HTML_HTA_VBSCRIPT_DOM_EXECUTE HTML_THIRD_PARTY_CREDENTIAL_HARVEST HTML_ACTIVEX_OBJECT HTML_WINDOWS_SCRIPTING_OBJECT HTML_VBSCRIPT HTML_CREDENTIAL_PHISH_DYNDNS HTML_SCRIPTED_COM_EXECUTION HTML_SMUGGLED_PAYLOAD HTML_XOR_BASE64_EVAL_INJECTION HTML_LONG_BASE64_SCRIPT_PAYLOAD HTML_AD_FRAUD_CLOAKING HTML_BASE64_PAYLOAD_URL