Matching script hash links executable drop to separate analysis
A sandbox report records a Windows executable dropping a VBScript and launching a script host beneath it. The dropped file’s hash matches a separately analysed script whose reports show JavaScript placements, logon-launch settings and HTTP exchanges, extending the investigation beyond the original binary without establishing one continuous execution trace.
A Windows executable’s sandbox report records a VBScript file in the Startup folder and a wscript.exe process beneath the executable. The script’s hash matches a separately analysed file whose own reports show JavaScript placement, logon-launch settings and HTTP exchanges with an external endpoint. The question is not simply whether the executable is malicious: how much of its activity continues through scripts, and which connections between those components can actually be demonstrated?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read