cscript[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cscript.exe
Size

184KB
MD5

280495b3b9f496b562a9645a81de365d
SHA1

2153191998d42488113735f0f4368034f9531cec
SHA256

b9701060ca88745b1b028e46e688691c2afc10c23020785ea14cd63569b32183
SHA512

00ee6af9f8bb309031ea1982e923bdcd9577349b294bd4ed19ff94d2f8af761da9e95bc7cd98b64bb5303272929cd4ce091422c89102b1d0a3bd9b5b517216d9
SSDEEP

3072:8r6ZVOG4n0sUBZZ5kTOq8vuTiSPV8A0eWhjUkOoP5pF6IZxtt:8rVRnqDrkLY7SeAqGoP5pFfZh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cscript.exe

Files

cscript.exe
.exe windows:10 windows x64 arch:x64

736ca1298aa3e3872aa7f678e8f25425

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

cscript.pdb

Imports

msvcrt

sprintf_s
__C_specific_handler
_vsnprintf
_swab
strcpy_s
_itow_s
wcscpy_s
memmove
free
swprintf_s
_itow
_wcsicmp
_wcsnicmp
wcsncmp
bsearch
_callnewh
malloc
memmove_s
memcpy_s
_vsnwprintf
wcscat_s
wcsrchr
memcmp
memcpy
memset

oleaut32

SysFreeString
SysStringLen
SafeArrayCopy
SysAllocString
CreateErrorInfo
SetErrorInfo
VariantClear
SysAllocStringLen
VariantCopy
VariantInit
VariantChangeType
SafeArrayGetElement
LoadTypeLi
LoadRegTypeLi
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayPutElement
SafeArrayGetUBound

kernel32

CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
GetCommandLineW
ReleaseSemaphore
GetPrivateProfileStringA
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
GetModuleHandleA
GetCommandLineA
MultiByteToWideChar
FormatMessageW
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
WideCharToMultiByte
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetPrivateProfileIntA
WriteConsoleW
GetLastError
GetPrivateProfileStringW
GetConsoleMode
WriteFile
GetPrivateProfileIntW
GetStdHandle
HeapReAlloc
LoadLibraryW
GetLocaleInfoA
GetLocaleInfoW
GetFullPathNameA
GetFullPathNameW
FlushFileBuffers
GetTempFileNameA
GetSystemDirectoryA
CreateFileA
GetTempPathA
UnmapViewOfFile
LoadLibraryExA
GetUserDefaultLCID
CreateEventA
CreateThread
SetEvent
CreateFileMappingA
GetVersionExA
GetFileSize
LocalAlloc
MapViewOfFile
LocalFree
FormatMessageA
LoadLibraryExW
FindFirstFileW
FindFirstFileA
FindClose
GetFileAttributesW
GetACP
CreateFileW
SearchPathW
GetCPInfo
GetModuleFileNameA
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetModuleFileNameW
GetVersionExW
FindResourceExW
InitializeCriticalSection
LoadResource
RtlLookupFunctionEntry
FreeLibrary
GetFileAttributesA
CreateFileMappingW

ole32

CoUninitialize
CoInitialize
MkParseDisplayName
CLSIDFromProgID
CoGetClassObject
CoGetTreatAsClass
CreateFileMoniker
CoInitializeSecurity
CreateBindCtx
CoRegisterMessageFilter
CoCreateInstance
CLSIDFromString

advapi32

RegQueryValueExA
RegCreateKeyA
RegOpenKeyExA
LookupAccountNameW
ReportEventW
RegEnumKeyExA
RegCloseKey
RegisterEventSourceW
GetUserNameW
DeregisterEventSource
IsTextUnicode
ImpersonateLoggedOnUser
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCreateKeyExA
RegSetValueExA

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

user32

DispatchMessageA
GetMessageA
GetClassNameA
GetActiveWindow
MsgWaitForMultipleObjects
SetTimer
PostMessageA
DefWindowProcA
CreateWindowExA
SetWindowLongPtrA
TranslateMessage
GetClassInfoA
GetParent
RegisterClassA
MsgWaitForMultipleObjectsEx
PostQuitMessage
SendMessageA
EnumThreadWindows
LoadStringW
LoadStringA
PeekMessageA
GetWindowLongPtrA
KillTimer
CharNextA
IsWindowVisible

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

736ca1298aa3e3872aa7f678e8f25425

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

kernel32

ole32

advapi32

version

user32

Sections

.text Size: 100KB - Virtual size: 100KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 100KB - Virtual size: 100KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 3KB - Virtual size: 2KB