Analyzing Malicious Vbscript And Wsf

---
name: analyzing-malicious-vbscript-and-wsf
description: 'Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers,
  decoding VBScript.Encode (#@~^) and string obfuscation, and identifying WScript.Shell/ActiveX
  abuse to recover dropper behavior. Activates for requests to analyze VBScript, decode a WSF/HTA,
  or investigate a Windows Script Host dropper.'
domain: cybersecurity
subdomain: malware-analysis
tags:
  - malware-analysis
  - vbscript
  - wsf
  - hta
  - document-malware
  - deobfuscation
version: 1.0.0
author: analyst-ai-pack
license: Apache-2.0
mitre_attack:
  - T1059.005
  - T1059.003
  - T1027
d3fend:
  - D3-FCR
  - D3-DA
references:
  - 'Microsoft Windows Script Host documentation — https://learn.microsoft.com/previous-versions/windows/internet-explorer/ie-developer/scripting-articles/'
  - 'VBScript.Encode / Script Encoder format analysis — https://gist.github.com/bcse/1834878'
---

# Analyzing Malicious VBScript and WSF

## When to Use

- You have a `.vbs`, `.wsf`, or `.hta` delivered via phishing and need its real behavior.
- You must decode `VBScript.Encode`-obfuscated script (the `#@~^` marker) or string obfuscation.
- You are identifying WScript.Shell/ActiveX-based dropper actions and IOCs.

**Do not use** `wscript`/`cscript`/`mshta` to run the script for analysis — that executes the
dropper. Decode and read it statically.

## Prerequisites

- A static decoder (Python) or a script sandbox; the sample handled inertly in the lab.

## Safety & Handling

- Never run the script with Windows Script Host (`wscript`/`cscript`/`mshta`).
- Defang recovered URLs; store dropped payloads password-protected.

## Workflow

### Step 1: Parse the container

For WSF, parse the XML `<job>`/`<script>` elements (a WSF can bundle multiple languages). For HTA,
separate the HTML wrapper from the `<script>` body.

```bash
python scripts/analyst.py analyze sample.wsf
```

### Step 2: Decode VBScript.Encode

If you see the `#@~^` header, decode the Microsoft Script Encoder stream back to source.

### Step 3: Unroll string obfuscation

Resolve `Chr()`/`Asc()` builds, string concatenation, and `Replace()`-based deobfuscators to
reveal commands and URLs.

### Step 4: Identify dropper actions and IOCs

Find `CreateObject("WScript.Shell")`, `Run`/`Exec`, ADODB/MSXML download patterns, and PowerShell
hand-offs; recover URLs/paths, defang, and route payloads onward.

## Validation

- WSF/HTA containers are decomposed into their script bodies (all jobs/languages).
- `VBScript.Encode` streams are decoded to readable source.
- Dropper actions and IOCs are recovered without executing the script.

## Pitfalls

- Executing with `wscript`/`mshta` to "see" behavior, infecting the host.
- Missing one `<script>` block in a multi-job WSF.
- Overlooking the `#@~^` encoded section and analyzing only the cleartext stub.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the WSF/VBScript decoder.
- Windows Script Host docs and the Script Encoder format (linked in frontmatter).