agentsclimarketplace
Sign in

Analyzing malicious vbscript and wsf

Skill meltedinhex/analyst-ai-pack/skills/analyzing-malicious-vbscript-and-wsf

Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers, decoding VBScript.Encode (#@~^) and string obfuscation, and identifying WScript.Shell/ActiveX abuse to recover dropper behavior. Activates for requests to analyze VBScript, decode a WSF/HTA, or investigate a Windows Script Host dropper.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-vbscript-and-wsf

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
  • runs commandsInstructs the agent to run 1 command, including `python scripts/analyst.py analyze sample.wsf`.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.0 KB, 549 tokens by cl100k_base, as published. Nobody here has run it

Analyzing Malicious VBScript and WSF

When to Use

  • You have a .vbs, .wsf, or .hta delivered via phishing and need its real behavior.
  • You must decode VBScript.Encode-obfuscated script (the #@~^ marker) or string obfuscation.
  • You are identifying WScript.Shell/ActiveX-based dropper actions and IOCs.

Do not use wscript/cscript/mshta to run the script for analysis — that executes the dropper. Decode and read it statically.

Prerequisites

  • A static decoder (Python) or a script sandbox; the sample handled inertly in the lab.

Safety & Handling

  • Never run the script with Windows Script Host (wscript/cscript/mshta).
  • Defang recovered URLs; store dropped payloads password-protected.

Workflow

Step 1: Parse the container

For WSF, parse the XML <job>/<script> elements (a WSF can bundle multiple languages). For HTA, separate the HTML wrapper from the <script> body.

python scripts/analyst.py analyze sample.wsf

Step 2: Decode VBScript.Encode

If you see the #@~^ header, decode the Microsoft Script Encoder stream back to source.

Step 3: Unroll string obfuscation

Resolve Chr()/Asc() builds, string concatenation, and Replace()-based deobfuscators to reveal commands and URLs.

Step 4: Identify dropper actions and IOCs

Find CreateObject("WScript.Shell"), Run/Exec, ADODB/MSXML download patterns, and PowerShell hand-offs; recover URLs/paths, defang, and route payloads onward.

Validation

  • WSF/HTA containers are decomposed into their script bodies (all jobs/languages).
  • VBScript.Encode streams are decoded to readable source.
  • Dropper actions and IOCs are recovered without executing the script.

Pitfalls

  • Executing with wscript/mshta to "see" behavior, infecting the host.
  • Missing one <script> block in a multi-job WSF.
  • Overlooking the #@~^ encoded section and analyzing only the cleartext stub.

References

  • See references/api-reference.md for the WSF/VBScript decoder.
  • Windows Script Host docs and the Script Encoder format (linked in frontmatter).

What ships with it: 3 files

4.1 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.