wscript.pdb
Static task
static1
General
-
Target
wscript.exe
-
Size
151KB
-
MD5
cb92e015fff72169011c468b7f274b7d
-
SHA1
4123822dac499771d27af138297a34e94a0f3682
-
SHA256
a655040c4e12b830a2e60c23d0b1e60ba777d7e82ec99230e69727398ecbb0ea
-
SHA512
ed3eca5843224823e39aa2a090d40681e704676955a0503c38ba07c7d4ba6711cd69817d0a34a6b1503bb7e0925755e5c27912a9ce7eb7a802e12e56bca5a71c
-
SSDEEP
3072:TQypOw53zz4YX1vsVHyXLHvKi3oTwLMqQMQGF9unCFD+oLuGTxt5:nswx/4YdsVSXhoTU1QMQEWzoLtT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wscript.exe
Files
-
wscript.exe.exe windows:10 windows x86 arch:x86
c9a3c3279778943a19f6972c799fc1b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
memcpy
memcmp
_ftol2
wcsncmp
memmove
_except_handler4_common
free
_callnewh
malloc
sprintf_s
memmove_s
wcscpy_s
_vsnprintf
memcpy_s
_vsnwprintf
_wcsnicmp
_wcsicmp
_itow
_itow_s
wcsrchr
_beginthread
_endthread
wcscat_s
_swab
swprintf_s
strcpy_s
memset
oleaut32
SetErrorInfo
CreateErrorInfo
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayPutElement
SafeArrayCreate
SysStringLen
SysAllocStringLen
SafeArrayCopy
LoadRegTypeLi
SafeArrayGetLBound
SysAllocStringByteLen
SysAllocString
VariantInit
VariantCopy
LoadTypeLi
SafeArrayGetElement
LoadTypeLibEx
VariantChangeType
VariantClear
UnRegisterTypeLi
SysFreeString
kernel32
InitializeCriticalSection
GetCurrentThreadId
HeapReAlloc
DeleteCriticalSection
GetFullPathNameA
GetFullPathNameW
GetCPInfo
GetFileAttributesA
GetModuleHandleA
GetStartupInfoA
ExitProcess
GetLastError
GetACP
GetFileAttributesW
GetModuleFileNameA
FindClose
CreateSemaphoreExW
HeapFree
SetLastError
GetCommandLineW
ReleaseSemaphore
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
CreateFileMappingW
WaitForSingleObject
ReleaseMutex
GetCommandLineA
MultiByteToWideChar
FormatMessageW
ReleaseSRWLockExclusive
EnterCriticalSection
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
GetLocaleInfoW
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
GetLocaleInfoA
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
GetPrivateProfileIntW
LoadResource
FindFirstFileA
FindFirstFileW
IsDebuggerPresent
GetPrivateProfileStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
FindResourceExW
GetVersionExA
GetPrivateProfileIntA
GetConsoleMode
GetModuleFileNameW
SearchPathW
GetPrivateProfileStringA
GetStdHandle
CreateFileW
CreateEventA
CreateThread
LCIDToLocaleName
UnmapViewOfFile
FreeLibrary
SetEvent
LoadLibraryExW
LocalAlloc
GetVersionExW
LocalFree
GetSystemDefaultUILanguage
FormatMessageA
GetUserDefaultLCID
CreateFileMappingA
GetFileSize
MapViewOfFile
GetLocaleInfoEx
GetUserDefaultUILanguage
LeaveCriticalSection
WriteFile
LoadLibraryExA
CloseHandle
GetTempPath2A
CreateFileA
GetSystemDirectoryA
GetTempFileNameA
FlushFileBuffers
user32
MsgWaitForMultipleObjects
GetClassNameA
PostMessageA
PostThreadMessageA
LoadStringA
MsgWaitForMultipleObjectsEx
SetTimer
SetWindowLongA
LoadStringW
CharNextA
GetWindowLongA
RegisterClassA
DefWindowProcA
GetMessageA
DispatchMessageA
CreateWindowExA
TranslateMessage
GetActiveWindow
GetClassInfoA
SendMessageA
EnumThreadWindows
PeekMessageA
KillTimer
PostQuitMessage
GetParent
IsWindowVisible
MessageBoxW
ole32
MkParseDisplayName
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CoInitializeSecurity
CreateFileMoniker
CoGetTreatAsClass
CreateBindCtx
CoRegisterMessageFilter
CoGetMalloc
CoRegisterClassObject
StringFromCLSID
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoInitialize
CoRevokeClassObject
advapi32
GetUserNameW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
LookupAccountNameW
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
IsTextUnicode
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyA
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyA
RegQueryValueExW
RegSetValueA
RegDeleteKeyA
ImpersonateLoggedOnUser
RegQueryValueA
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoA
Sections
.text Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ