cscript[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cscript.exe
Size

157KB
MD5

24590bf74bbbbfd7d7ac070f4e3c44fd
SHA1

cdfe517d07f18623778829aa98d6bbadd3f294cd
SHA256

ae37fd1b642e797b36b9ffcec8a6e986732d011681061800c6b74426c28a9d03
SHA512

ffaf2c86c9555513cdb51a7638f1fde3e8951a203aac63fd0aac62db297c853ac8c14e1a212c01d6b181df53e790f80489358489f6415d5c7fa53bfb8888bfa9
SSDEEP

3072:O4jcFp8lMpEXjBEezimaUcmm0R/MsDM9/KhjULtgiTt6IZxttN:jjcY+yXjBEeGmaNmmnCLUgEtfZhN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cscript.exe

Files

cscript.exe
.exe windows x64

Password: infected

5691fe87118c57b106e12412bb7d0bd7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
_vsnprintf
_swab
strcpy_s
sprintf_s
swprintf_s
_itow
_vsnwprintf
_wcsicmp
_wcsnicmp
wcsncmp
bsearch
_itow_s
wcscpy_s
memmove
free
_callnewh
malloc
wcscat_s
wcsrchr
memcmp
memcpy
memset

oleaut32

SysAllocStringLen
VariantCopy
VariantInit
SetErrorInfo
VariantChangeType
SafeArrayGetElement
LoadTypeLi
SafeArrayCreate
CreateErrorInfo
SysAllocString
VariantClear
SafeArrayPutElement
SafeArrayGetUBound
SafeArrayDestroy
LoadRegTypeLi
SafeArrayCopy
SysFreeString
SafeArrayGetLBound
SysStringLen

kernel32

GetCommandLineA
MultiByteToWideChar
ExitProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CreateFileMappingA
UnmapViewOfFile
CreateFileW
GetPrivateProfileStringA
GetPrivateProfileIntA
GetFileSize
GetCommandLineW
GetPrivateProfileStringW
MapViewOfFile
WideCharToMultiByte
GetPrivateProfileIntW
WriteConsoleW
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetFullPathNameA
GetFullPathNameW
FlushFileBuffers
GetTempFileNameA
GetSystemDirectoryA
CreateFileA
GetTempPathA
GetConsoleMode
LoadLibraryExA
LocalAlloc
FormatMessageW
GetUserDefaultLCID
GetProcAddress
LocalFree
FormatMessageA
LoadLibraryExW
FindFirstFileW
FindFirstFileA
FindClose
GetFileAttributesW
GetACP
GetFileAttributesA
WriteFile
GetCPInfo
GetModuleFileNameA
GetStdHandle
CreateEventA
GetModuleFileNameW
CreateThread
GetModuleHandleA
InitializeCriticalSection
SetEvent
SearchPathW
SetLastError
CloseHandle
GetVersionExA
GetSystemDefaultUILanguage
DeleteCriticalSection
FreeLibrary
CreateFileMappingW
GetUserDefaultUILanguage
LeaveCriticalSection
GetVersionExW
FindResourceExW
LoadResource
EnterCriticalSection
LoadLibraryW

ole32

CoInitializeSecurity
CoCreateInstance
CLSIDFromString
CoGetTreatAsClass
CreateFileMoniker
CoInitialize
CoUninitialize
CoRegisterMessageFilter
CoGetClassObject
CLSIDFromProgID
MkParseDisplayName
CreateBindCtx

advapi32

LookupAccountNameW
GetUserNameW
RegisterEventSourceW
ReportEventW
RegCreateKeyA
RegQueryValueExA
IsTextUnicode
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
ImpersonateLoggedOnUser
DeregisterEventSource
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCreateKeyExA

version

GetFileVersionInfoSizeA
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW

user32

GetMessageA
DispatchMessageA
GetParent
IsWindowVisible
PostMessageA
GetClassNameA
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
SetWindowLongPtrA
SetTimer
GetActiveWindow
LoadStringW
LoadStringA
RegisterClassA
DefWindowProcA
CreateWindowExA
CharNextA
TranslateMessage
GetClassInfoA
SendMessageA
EnumThreadWindows
PeekMessageA
GetWindowLongPtrA
KillTimer
PostQuitMessage

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

5691fe87118c57b106e12412bb7d0bd7

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

oleaut32

kernel32

ole32

advapi32

version

user32

Sections

.text Size: 78KB - Virtual size: 77KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 78KB - Virtual size: 77KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 2KB - Virtual size: 2KB