cscript.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cscript.exe
Resource
win10v2004-20240802-en
General
-
Target
cscript.exe
-
Size
184KB
-
MD5
280495b3b9f496b562a9645a81de365d
-
SHA1
2153191998d42488113735f0f4368034f9531cec
-
SHA256
b9701060ca88745b1b028e46e688691c2afc10c23020785ea14cd63569b32183
-
SHA512
00ee6af9f8bb309031ea1982e923bdcd9577349b294bd4ed19ff94d2f8af761da9e95bc7cd98b64bb5303272929cd4ce091422c89102b1d0a3bd9b5b517216d9
-
SSDEEP
3072:8r6ZVOG4n0sUBZZ5kTOq8vuTiSPV8A0eWhjUkOoP5pF6IZxtt:8rVRnqDrkLY7SeAqGoP5pFfZh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cscript.exe
Files
-
cscript.exe.exe windows:10 windows x64 arch:x64
736ca1298aa3e3872aa7f678e8f25425
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcrt
sprintf_s
__C_specific_handler
_vsnprintf
_swab
strcpy_s
_itow_s
wcscpy_s
memmove
free
swprintf_s
_itow
_wcsicmp
_wcsnicmp
wcsncmp
bsearch
_callnewh
malloc
memmove_s
memcpy_s
_vsnwprintf
wcscat_s
wcsrchr
memcmp
memcpy
memset
oleaut32
SysFreeString
SysStringLen
SafeArrayCopy
SysAllocString
CreateErrorInfo
SetErrorInfo
VariantClear
SysAllocStringLen
VariantCopy
VariantInit
VariantChangeType
SafeArrayGetElement
LoadTypeLi
LoadRegTypeLi
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayPutElement
SafeArrayGetUBound
kernel32
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
GetCommandLineW
ReleaseSemaphore
GetPrivateProfileStringA
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
GetModuleHandleA
GetCommandLineA
MultiByteToWideChar
FormatMessageW
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
WideCharToMultiByte
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetPrivateProfileIntA
WriteConsoleW
GetLastError
GetPrivateProfileStringW
GetConsoleMode
WriteFile
GetPrivateProfileIntW
GetStdHandle
HeapReAlloc
LoadLibraryW
GetLocaleInfoA
GetLocaleInfoW
GetFullPathNameA
GetFullPathNameW
FlushFileBuffers
GetTempFileNameA
GetSystemDirectoryA
CreateFileA
GetTempPathA
UnmapViewOfFile
LoadLibraryExA
GetUserDefaultLCID
CreateEventA
CreateThread
SetEvent
CreateFileMappingA
GetVersionExA
GetFileSize
LocalAlloc
MapViewOfFile
LocalFree
FormatMessageA
LoadLibraryExW
FindFirstFileW
FindFirstFileA
FindClose
GetFileAttributesW
GetACP
CreateFileW
SearchPathW
GetCPInfo
GetModuleFileNameA
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetModuleFileNameW
GetVersionExW
FindResourceExW
InitializeCriticalSection
LoadResource
RtlLookupFunctionEntry
FreeLibrary
GetFileAttributesA
CreateFileMappingW
ole32
CoUninitialize
CoInitialize
MkParseDisplayName
CLSIDFromProgID
CoGetClassObject
CoGetTreatAsClass
CreateFileMoniker
CoInitializeSecurity
CreateBindCtx
CoRegisterMessageFilter
CoCreateInstance
CLSIDFromString
advapi32
RegQueryValueExA
RegCreateKeyA
RegOpenKeyExA
LookupAccountNameW
ReportEventW
RegEnumKeyExA
RegCloseKey
RegisterEventSourceW
GetUserNameW
DeregisterEventSource
IsTextUnicode
ImpersonateLoggedOnUser
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCreateKeyExA
RegSetValueExA
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
user32
DispatchMessageA
GetMessageA
GetClassNameA
GetActiveWindow
MsgWaitForMultipleObjects
SetTimer
PostMessageA
DefWindowProcA
CreateWindowExA
SetWindowLongPtrA
TranslateMessage
GetClassInfoA
GetParent
RegisterClassA
MsgWaitForMultipleObjectsEx
PostQuitMessage
SendMessageA
EnumThreadWindows
LoadStringW
LoadStringA
PeekMessageA
GetWindowLongPtrA
KillTimer
CharNextA
IsWindowVisible
Sections
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ