I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The script is heavily obfuscated (i.e. not simply using execute), and I don't know how to begin to analyze it.

So far, i've tried the open source tool ViperMonkey, put it failed to trace the script.

Any suggestions?

  • You can share the sample? Thank you
    – incode
    Sep 23 '20 at 17:32

Try running the following from the command line:

cscript /x .\malwaresample.vbs

That should open it up in Visual Studios and allow you to step through it.

  • Unfortunately, I don't have Visual Studio :(
    – Sean W.
    Sep 20 '20 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.