wscript[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wscript.exe
Size

196KB
MD5

fb1897a7569d82715d682dbc1b7e6afe
SHA1

d4b9a9997ab997efe51844a70eeb9b767e1b8a66
SHA256

5a89158202a5dc54067418770a38792f15a622f82509a35ac2402e1476734da5
SHA512

a64406fa5fd852ad565761241cfea6c7c755ccc09626c75b37505987ad4103119a086b5a8ff866da021d46aadeb71fb30c774e8d12d7ee4d0a5c3cdb8bdc9715
SSDEEP

6144:PILsJPNsA+XUpxeSXSqowCVAPkc2Bxy2c7c81Ga24Wp22c0oO17IcJRFG/FPBJzn:PILsNNv+XUpxeSXSqowCVAPkc2Bxy2cT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wscript.exe

Files

wscript.exe
.exe windows:10 windows x64 arch:x64

4996577dd288903ac76aba0a33f90edb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wscript.pdb

Imports

msvcrt

memmove
memcpy
memcmp
wcsncmp
memset
free
_callnewh
malloc
sprintf_s
memmove_s
wcscpy_s
_vsnprintf
memcpy_s
_vsnwprintf
_beginthread
_wcsnicmp
_wcsicmp
_itow
_itow_s
wcsrchr
_endthread
__C_specific_handler
wcscat_s
_swab
swprintf_s
strcpy_s
strcmp

oleaut32

SetErrorInfo
CreateErrorInfo
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayPutElement
SafeArrayCreate
SysStringLen
SysAllocStringLen
SafeArrayCopy
LoadRegTypeLi
SafeArrayGetLBound
SysAllocStringByteLen
SysAllocString
VariantInit
VariantCopy
LoadTypeLi
SafeArrayGetElement
LoadTypeLibEx
VariantChangeType
VariantClear
UnRegisterTypeLi
SysFreeString

kernel32

InitializeCriticalSection
GetCurrentThreadId
HeapReAlloc
DeleteCriticalSection
GetFullPathNameA
GetFullPathNameW
GetCPInfo
GetFileAttributesA
GetModuleHandleA
GetStartupInfoA
ExitProcess
GetLastError
GetACP
GetFileAttributesW
GetModuleFileNameA
FindClose
CreateSemaphoreExW
HeapFree
SetLastError
GetCommandLineW
ReleaseSemaphore
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
CreateFileMappingW
WaitForSingleObject
ReleaseMutex
GetCommandLineA
MultiByteToWideChar
FormatMessageW
ReleaseSRWLockExclusive
EnterCriticalSection
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
GetLocaleInfoW
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
GetLocaleInfoA
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
GetPrivateProfileIntW
LoadResource
FindFirstFileA
FindFirstFileW
IsDebuggerPresent
GetPrivateProfileStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
FindResourceExW
GetVersionExA
GetPrivateProfileIntA
GetConsoleMode
GetModuleFileNameW
SearchPathW
GetPrivateProfileStringA
GetStdHandle
CreateFileW
CreateEventA
CreateThread
LCIDToLocaleName
UnmapViewOfFile
FreeLibrary
SetEvent
LoadLibraryExW
LocalAlloc
GetVersionExW
LocalFree
GetSystemDefaultUILanguage
FormatMessageA
GetUserDefaultLCID
CreateFileMappingA
GetFileSize
GetLocaleInfoEx
MapViewOfFile
GetUserDefaultUILanguage
LeaveCriticalSection
WriteFile
LoadLibraryExA
SetThreadpoolTimer
GetTempPath2A
CreateFileA
GetSystemDirectoryA
GetTempFileNameA
FlushFileBuffers

user32

MsgWaitForMultipleObjects
GetClassNameA
PostMessageA
PostThreadMessageA
LoadStringA
MsgWaitForMultipleObjectsEx
SetTimer
CharNextA
LoadStringW
RegisterClassA
DefWindowProcA
CreateWindowExA
TranslateMessage
GetMessageA
DispatchMessageA
GetClassInfoA
SendMessageA
GetActiveWindow
EnumThreadWindows
PeekMessageA
GetWindowLongPtrA
KillTimer
PostQuitMessage
GetParent
SetWindowLongPtrA
IsWindowVisible
MessageBoxW

ole32

MkParseDisplayName
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CoInitializeSecurity
CreateFileMoniker
CoGetTreatAsClass
CreateBindCtx
CoRegisterMessageFilter
CoGetMalloc
CoRegisterClassObject
StringFromCLSID
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoInitialize
CoRevokeClassObject

advapi32

RegisterEventSourceW
DeregisterEventSource
GetUserNameW
ReportEventW
LookupAccountNameW
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
IsTextUnicode
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyA
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyA
RegQueryValueExW
RegSetValueA
RegDeleteKeyA
ImpersonateLoggedOnUser
RegQueryValueA

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoA

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4996577dd288903ac76aba0a33f90edb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

kernel32

user32

ole32

advapi32

version

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 4KB - Virtual size: 2KB

.pdata Size: 8KB - Virtual size: 4KB

.rsrc Size: 40KB - Virtual size: 38KB

.reloc Size: 4KB - Virtual size: 924B

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 4KB - Virtual size: 2KB

.pdata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 40KB - Virtual size: 38KB

.reloc
Size: 4KB - Virtual size: 924B