cscript[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cscript.exe
Size

128KB
MD5

4f67a0c5cade72bd299d49481d5d1378
SHA1

cdee6465086f06ba600c0dbca07e7d682a365a43
SHA256

2ea98db050d2caf8e461713e375339879cc52af579b6874d4b935aa4fefe706b
SHA512

43657b8eeb791232e4a421a98381b35a66d33ff2588784c5bc83b2f30acf895c535a0b21378c43d31275ba41f46845a904d31738b296c9000365d76d362a1e39
SSDEEP

3072:Pw56qa0JjpmPGJ1/5jcXIfSuZHuh9yPKUWdvByqTxtlo:86MvtJF5dYh9ljBlTW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cscript.exe

Files

cscript.exe
.exe windows x86

a2bbc122fbe8dcd26dbe707ecc74e910

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler4_common
free
memmove
_callnewh
wcscat_s
_wcsicmp
_wcsnicmp
wcsncmp
_itow_s
_itow
wcsrchr
strcpy_s
_swab
_vsnprintf
sprintf_s
swprintf_s
_vsnwprintf
wcscpy_s
malloc
memcmp
memcpy
memset

oleaut32

VariantInit
SafeArrayGetElement
LoadTypeLi
VariantCopy
SafeArrayGetUBound
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
LoadRegTypeLi
SafeArrayCopy
SafeArrayGetLBound
SysFreeString
SysAllocString
VariantChangeType
SysAllocStringLen
CreateErrorInfo
SysStringLen
SetErrorInfo
VariantClear

kernel32

GetCommandLineA
MultiByteToWideChar
ExitProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadResource
FindResourceExW
LCIDToLocaleName
GetVersionExW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
SetLastError
SearchPathW
GetModuleHandleA
MapViewOfFile
GetFileSize
CreateFileMappingA
UnmapViewOfFile
CreateFileW
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringW
GetPrivateProfileIntW
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree
LoadLibraryW
GetLocaleInfoA
GetLocaleInfoW
GetFullPathNameA
LocalAlloc
FormatMessageW
GetFullPathNameW
GetProcAddress
LocalFree
FormatMessageA
LoadLibraryExW
FindFirstFileW
FindFirstFileA
FindClose
GetFileAttributesW
GetACP
GetFileAttributesA
FlushFileBuffers
GetCPInfo
GetModuleFileNameA
GetCommandLineW
GetTempFileNameA
GetModuleFileNameW
GetSystemDirectoryA
CreateFileA
InitializeCriticalSection
GetTempPathA
WideCharToMultiByte
LoadLibraryExA
GetUserDefaultLCID
CreateEventA
WriteConsoleW
DeleteCriticalSection
FreeLibrary
CreateThread
GetLastError
GetConsoleMode
WriteFile
SetEvent
GetStdHandle
CloseHandle
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
CreateFileMappingW

ole32

CoRegisterMessageFilter
CoInitializeSecurity
CoCreateInstance
CreateBindCtx
CreateFileMoniker
MkParseDisplayName
CLSIDFromProgID
CoGetClassObject
CoUninitialize
CoInitialize
CLSIDFromString
CoGetTreatAsClass

advapi32

RegisterEventSourceW
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
ImpersonateLoggedOnUser
IsTextUnicode
DeregisterEventSource
GetUserNameW
ReportEventW
LookupAccountNameW
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey

version

GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoSizeA

user32

TranslateMessage
GetActiveWindow
EnumThreadWindows
PeekMessageA
MsgWaitForMultipleObjectsEx
KillTimer
PostQuitMessage
GetParent
GetMessageA
LoadStringA
DispatchMessageA
CreateWindowExA
IsWindowVisible
CharNextA
PostMessageA
DefWindowProcA
GetClassNameA
MsgWaitForMultipleObjects
SetTimer
SetWindowLongA
GetClassInfoA
GetWindowLongA
RegisterClassA
SendMessageA
LoadStringW

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2bbc122fbe8dcd26dbe707ecc74e910

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

oleaut32

kernel32

ole32

advapi32

version

user32

Sections

.text Size: 83KB - Virtual size: 82KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 83KB - Virtual size: 82KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 5KB - Virtual size: 4KB