analyzing-malicious-vbscript-and-wsf

Name: analyzing-malicious-vbscript-and-wsf
Author: meltedinhex

18stars5forks

How to install analyzing-malicious-vbscript-and-wsf?

meltedinhex/analyst-ai-pack/analyzing-malicious-vbscript-and-wsf

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-vbscript-and-wsf

Installs into the current project.

Summary

Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers,

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious VBScript and WSF
2
3	## When to Use
4
5	- You have a `.vbs`, `.wsf`, or `.hta` delivered via phishing and need its real behavior.
6	- You must decode `VBScript.Encode`-obfuscated script (the `#@~^` marker) or string obfuscation.
7	- You are identifying WScript.Shell/ActiveX-based dropper actions and IOCs.
8
9	Do not use `wscript`/`cscript`/`mshta` to run the script for analysis — that executes the
10	dropper. Decode and read it statically.
11
12	## Prerequisites
13
14	- A static decoder (Python) or a script sandbox; the sample handled inertly in the lab.
15
16	## Safety & Handling
17
18	- Never run the script with Windows Script Host (`wscript`/`cscript`/`mshta`).
19	- Defang recovered URLs; store dropped payloads password-protected.
20
21	## Workflow
22
23	### Step 1: Parse the container
24
25	For WSF, parse the XML `<job>`/`<script>` elements (a WSF can bundle multiple languages). For HTA,
26	separate the HTML wrapper from the `<script>` body.
27
28	```bash
29	python scripts/analyst.py analyze sample.wsf
30	```
31
32	### Step 2: Decode VBScript.Encode
33
34	If you see the `#@~^` header, decode the Microsoft Script Encoder stream back to source.
35
36	### Step 3: Unroll string obfuscation
37
38	Resolve `Chr()`/`Asc()` builds, string concatenation, and `Replace()`-based deobfuscators to
39	reveal commands and URLs.
40
41	### Step 4: Identify dropper actions and IOCs
42
43	Find `CreateObject("WScript.Shell")`, `Run`/`Exec`, ADODB/MSXML download patterns, and PowerShell
44	hand-offs; recover URLs/paths, defang, and route payloads onward.
45
46	## Validation
47
48	- WSF/HTA containers are decomposed into their script bodies (all jobs/languages).
49	- `VBScript.Encode` streams are decoded to readable source.
50	- Dropper actions and IOCs are recovered without executing the script.
51
52	## Pitfalls
53
54	- Executing with `wscript`/`mshta` to "see" behavior, infecting the host.
55	- Missing one `<script>` block in a multi-job WSF.
56	- Overlooking the `#@~^` encoded section and analyzing only the cleartext stub.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the WSF/VBScript decoder.
61	- Windows Script Host docs and the Script Encoder format (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-malicious-vbscript-and-wsf

18stars5forks

View on GitHub

How to install analyzing-malicious-vbscript-and-wsf?

meltedinhex/analyst-ai-pack/analyzing-malicious-vbscript-and-wsf

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-vbscript-and-wsf

Installs into the current project.

Summary

Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers,

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious VBScript and WSF
2
3	## When to Use
4
5	- You have a `.vbs`, `.wsf`, or `.hta` delivered via phishing and need its real behavior.
6	- You must decode `VBScript.Encode`-obfuscated script (the `#@~^` marker) or string obfuscation.
7	- You are identifying WScript.Shell/ActiveX-based dropper actions and IOCs.
8
9	Do not use `wscript`/`cscript`/`mshta` to run the script for analysis — that executes the
10	dropper. Decode and read it statically.
11
12	## Prerequisites
13
14	- A static decoder (Python) or a script sandbox; the sample handled inertly in the lab.
15
16	## Safety & Handling
17
18	- Never run the script with Windows Script Host (`wscript`/`cscript`/`mshta`).
19	- Defang recovered URLs; store dropped payloads password-protected.
20
21	## Workflow
22
23	### Step 1: Parse the container
24
25	For WSF, parse the XML `<job>`/`<script>` elements (a WSF can bundle multiple languages). For HTA,
26	separate the HTML wrapper from the `<script>` body.
27
28	```bash
29	python scripts/analyst.py analyze sample.wsf
30	```
31
32	### Step 2: Decode VBScript.Encode
33
34	If you see the `#@~^` header, decode the Microsoft Script Encoder stream back to source.
35
36	### Step 3: Unroll string obfuscation
37
38	Resolve `Chr()`/`Asc()` builds, string concatenation, and `Replace()`-based deobfuscators to
39	reveal commands and URLs.
40
41	### Step 4: Identify dropper actions and IOCs
42
43	Find `CreateObject("WScript.Shell")`, `Run`/`Exec`, ADODB/MSXML download patterns, and PowerShell
44	hand-offs; recover URLs/paths, defang, and route payloads onward.
45
46	## Validation
47
48	- WSF/HTA containers are decomposed into their script bodies (all jobs/languages).
49	- `VBScript.Encode` streams are decoded to readable source.
50	- Dropper actions and IOCs are recovered without executing the script.
51
52	## Pitfalls
53
54	- Executing with `wscript`/`mshta` to "see" behavior, infecting the host.
55	- Missing one `<script>` block in a multi-job WSF.
56	- Overlooking the `#@~^` encoded section and analyzing only the cleartext stub.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the WSF/VBScript decoder.
61	- Windows Script Host docs and the Script Encoder format (linked in frontmatter).

People who liked this also viewed

6 picks

Type