24590bf74bbbbfd7d7ac070f4e3c44fd
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2021-May-02 20:32:56 |
| Detected languages |
English - United States
|
| Debug artifacts |
cscript.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft ® Console Based Script Host |
| FileVersion | 5.812.10240.16384 |
| InternalName | cscript.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | cscript.exe |
| ProductName | Microsoft ® Windows Script Host |
| ProductVersion | 5.812.10240.16384 |
Plugin Output
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/69 (Scanned on 2022-02-10 14:28:40) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2021-May-02 20:32:56 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x13800 |
| SizeOfInitializedData | 0x14200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000002880 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | A.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2c000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x2cc94 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x8000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.rsrc
.reloc
Imports
| msvcrt.dll |
__C_specific_handler
_vsnprintf _swab strcpy_s sprintf_s swprintf_s _itow _vsnwprintf _wcsicmp _wcsnicmp wcsncmp bsearch _itow_s wcscpy_s memmove free _callnewh malloc wcscat_s wcsrchr memcmp memcpy memset |
|---|---|
| OLEAUT32.dll |
SysAllocStringLen
VariantCopy VariantInit SetErrorInfo VariantChangeType SafeArrayGetElement LoadTypeLib SafeArrayCreate CreateErrorInfo SysAllocString VariantClear SafeArrayPutElement SafeArrayGetUBound SafeArrayDestroy LoadRegTypeLib SafeArrayCopy SysFreeString SafeArrayGetLBound SysStringLen |
| KERNEL32.dll |
GetCommandLineA
MultiByteToWideChar ExitProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess CreateFileMappingA UnmapViewOfFile CreateFileW GetPrivateProfileStringA GetPrivateProfileIntA GetFileSize GetCommandLineW GetPrivateProfileStringW MapViewOfFile WideCharToMultiByte GetPrivateProfileIntW WriteConsoleW GetProcessHeap HeapAlloc HeapReAlloc HeapFree GetLastError GetLocaleInfoA GetLocaleInfoW GetFullPathNameA GetFullPathNameW FlushFileBuffers GetTempFileNameA GetSystemDirectoryA CreateFileA GetTempPathA GetConsoleMode LoadLibraryExA LocalAlloc FormatMessageW GetUserDefaultLCID GetProcAddress LocalFree FormatMessageA LoadLibraryExW FindFirstFileW FindFirstFileA FindClose GetFileAttributesW GetACP GetFileAttributesA WriteFile GetCPInfo GetModuleFileNameA GetStdHandle CreateEventA GetModuleFileNameW CreateThread GetModuleHandleA InitializeCriticalSection SetEvent SearchPathW SetLastError CloseHandle GetVersionExA GetSystemDefaultUILanguage DeleteCriticalSection FreeLibrary CreateFileMappingW GetUserDefaultUILanguage LeaveCriticalSection GetVersionExW FindResourceExW LoadResource EnterCriticalSection LoadLibraryW |
| OLE32.dll |
CoInitializeSecurity
CoCreateInstance CLSIDFromString CoGetTreatAsClass CreateFileMoniker CoInitialize CoUninitialize CoRegisterMessageFilter CoGetClassObject CLSIDFromProgID MkParseDisplayName CreateBindCtx |
| ADVAPI32.dll |
LookupAccountNameW
GetUserNameW RegisterEventSourceW ReportEventW RegCreateKeyA RegQueryValueExA IsTextUnicode RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey ImpersonateLoggedOnUser DeregisterEventSource RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCreateKeyExA |
| VERSION.dll |
GetFileVersionInfoSizeA
VerQueryValueA VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoA GetFileVersionInfoW |
| USER32.dll |
GetMessageA
DispatchMessageA GetParent IsWindowVisible PostMessageA GetClassNameA MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx SetWindowLongPtrA SetTimer GetActiveWindow LoadStringW LoadStringA RegisterClassA DefWindowProcA CreateWindowExA CharNextA TranslateMessage GetClassInfoA SendMessageA EnumThreadWindows PeekMessageA GetWindowLongPtrA KillTimer PostQuitMessage |
Delayed Imports
| Ordinal | 1 |
|---|---|
| Address | 0x1890 |
1
1 (#2)
1 (#3)
1 (#4)
2
3
63
126
127
132
191
194
201
207
208
213
219
1 (#5)
1 (#6)
1 (#7)
String Table contents
| Windows Script Host |
| Windows Script Host (debugging disabled) |
| Windows Script Host Error |
| Windows Script Host Input Error |
| This Unicode version of Windows Script Host will only execute under Windows NT. |
| Please use the ANSI version of Windows Script Host." |
| Usage: |
| Options: |
| value |
| wsh |
| Windows Script Host |
| Windows Script Host (debugging disabled) |
| Usage: CScript scriptname.extension [option...] [arguments...] |
| Options: |
| //B Batch mode: Suppresses script errors and prompts from displaying |
| //D Enable Active Debugging |
| //E:engine Use engine for executing script |
| //H:CScript Changes the default script host to CScript.exe |
| //H:WScript Changes the default script host to WScript.exe (default) |
| //I Interactive mode (default, opposite of //B) |
| //Job:xxxx Execute a WSF job |
| //Logo Display logo (default) |
| //Nologo Prevent logo display: No banner will be shown at execution time |
| //S Save current command line options for this user |
| //T:nn Time out in seconds: Maximum time a script is permitted to run |
| //X Execute script in debugger |
| //U Use Unicode for redirected I/O from the console |
| Usage: CScript scriptname.extension [option...] [arguments...] |
| Options: |
| //B Batch mode: Suppresses script errors and prompts from displaying |
| //D Enable Active Debugging |
| //E:engine Use engine for executing script |
| //H:CScript Changes the default script host to CScript.exe |
| //H:WScript Changes the default script host to WScript.exe (default) |
| //I Interactive mode (default, opposite of //B) |
| //Job:xxxx Execute a WSF job |
| //Logo Display logo (default) |
| //Nologo Prevent logo display: No banner will be shown at execution time |
| //S Save current command line options for this user |
| //T:nn Time out in seconds: Maximum time a script is permitted to run |
| //X Execute script in debugger |
| CScript Error |
| Input Error |
| This Unicode version of CScript will only execute under Windows NT. |
| Please use the ANSI version of CScript." |
| %1!ls!(%2!u!, %3!u!) %4!ls!: %5!ls! |
| Microsoft (R) Windows Script Host Version %1!u!.%2!u! |
| Copyright (C) Microsoft Corporation. All rights reserved. |
| The Windows Script Host settings have been reset to default. |
| Command line options are saved. |
| The default script host is now set to "wscript.exe". |
| The default script host is now set to "cscript.exe". |
| Successful execution of Windows Script Host. |
| Successful remote execution of Windows Script Host. |
| Script execution time was exceeded on script "%1!ls!". |
| Script execution was terminated. |
| Could not locate automation class named "%1!ls!". |
| Could not connect object. |
| Could not create object named "%1!ls!". |
| Initialization of the Windows Script Host failed. |
| Can't find script engine "%2!ls!" for script "%1!ls!". |
| Can't change default script host. |
| An attempt at saving your settings via the //S option failed. |
| Loading script "%1!ls!" failed (%2!ls!). |
| Loading your settings failed. |
| Execution of the Windows Script Host failed. |
| Unexpected error of the Windows Script Host. |
| Windows Script Host access is disabled on this machine. Contact your administrator for details. |
| Attempt to execute Windows Script Host while it is disabled. |
| Attempt to execute Windows Script Host remotely while remote execution is disabled. |
| //T option requires timeout value. |
| Invalid timeout value for //T option. |
| Unknown option "%1!ls!" specified. |
| Extra argument specified to option "%1!ls!". |
| There is no script file specified. |
| Command line option mismatch. |
| There is no file extension in "%1!ls!". |
| //H option requires host name. |
| Host name for //H option must be "cscript" or "wscript". |
| There is no script engine for file extension "%1!ls!". |
| Can not find script file "%1!ls!". |
| Invalid pathname. |
| Need -E option. |
| -E option requires name of script engine. |
| Can't read script from stdin. |
| //CP option requires code page value. |
| Invalid code page value for //CP option. |
| Missing job name. |
| Unicode is not supported on this platform. |
| Unable to find job "%1!ls!". |
| Script setting file "%1!ls!" is invalid. |
| Invalid #codepage directive. |
| Win32 Error 0x%X |
| %1!ls! (%2!ls!) |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 5.812.10240.16384 |
| ProductVersion | 5.812.10240.16384 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft ® Console Based Script Host |
| FileVersion (#2) | 5.812.10240.16384 |
| InternalName | cscript.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | cscript.exe |
| ProductName | Microsoft ® Windows Script Host |
| ProductVersion (#2) | 5.812.10240.16384 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-May-02 20:32:56 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x1b960 |
| PointerToRawData | 0x1a560 |
| Referenced File | cscript.pdb |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-May-02 20:32:56 |
| Version | 0.0 |
| SizeofData | 800 |
| AddressOfRawData | 0x1b984 |
| PointerToRawData | 0x1a584 |
UNKNOWN
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-May-02 20:32:56 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x1bca4 |
| PointerToRawData | 0x1a8a4 |
TLS Callbacks
Load Configuration
| Size | 0x118 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14001f1f0 |
| GuardCFCheckFunctionPointer | 5368810632 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
RICH Header
| XOR Key | 0x22152913 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 10 |
| C objects (27412) | 17 |
| ASM objects (27412) | 3 |
| Total imports | 189 |
| Imports (27412) | 5 |
| C++ objects (27412) | 2 |
| 269 (27412) | 38 |
| Exports (27412) | 1 |
| Resource objects (27412) | 1 |
| Linker (27412) | 1 |