I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The script is heavily obfuscated (i.e. not simply using
execute), and I don't know how to begin to analyze it.
So far, i've tried the open source tool ViperMonkey, put it failed to trace the script.