SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-malicious-vbscript-and-wsf
0
Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers, decoding VBScript.Encode (#@~^) and string obfuscation, and identifying WScript.Shell/ActiveX abuse to recover dropper behavior. Activates for requests to analyze VBScript, decode a WSF/HTA, or investigate a Windows Script Host dropper.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Malicious VBScript and WSF
## When to Use
- You have a `.vbs`, `.wsf`, or `.hta` delivered via phishing and need its real behavior.
- You must decode `VBScript.Encode`-obfuscated script (the `#@~^` marker) or string obfuscation.
- You are identifying WScript.Shell/ActiveX-based dropper actions and IOCs.
**Do not use** `wscript`/`cscript`/`mshta` to run the script for analysis — that executes the
dropper. Decode and read it statically.
## Prerequisites
- A static decoder (Python) or a script sandbox; the sample handled inertly in the lab.
## Safety & Handling
- Never run the script with Windows Script Host (`wscript`/`cscript`/`mshta`).
- Defang recovered URLs; store dropped payloads password-protected.
## Workflow
### Step 1: Parse the container
For WSF, parse the XML `<job>`/`<script>` elements (a WSF can bundle multiple languages). For HTA,
separate the HTML wrapper from the `<script>` body.
```bash
python scripts/analyst.py analyze sample.wsf
```
### Step 2: Decode VBScript.Encode
If you see the `#@~^` header, decode the Microsoft Script Encoder stream back to source.
### Step 3: Unroll string obfuscation
Resolve `Chr()`/`Asc()` builds, string concatenation, and `Replace()`-based deobfuscators to
reveal commands and URLs.
### Step 4: Identify dropper actions and IOCs
Find `CreateObject("WScript.Shell")`, `Run`/`Exec`, ADODB/MSXML download patterns, and PowerShell
hand-offs; recover URLs/paths, defang, and route payloads onward.
## Validation
- WSF/HTA containers are decomposed into their script bodies (all jobs/languages).
- `VBScript.Encode` streams are decoded to readable source.
- Dropper actions and IOCs are recovered without executing the script.
## Pitfalls
- Executing with `wscript`/`mshta` to "see" behavior, infecting the host.
- Missing one `<script>` block in a multi-job WSF.
- Overlooking the `#@~^` encoded section and analyzing only the cleartext stub.
## References
- See [`references/api-reference.md`](references/api-reference.md) for the WSF/VBScript decoder.
- Windows Script Host docs and the Script Encoder format (linked in frontmatter).