filenamecscript.exe
size135168 (0x21000)
md523d42c651f89420f7232aeb7a2a43d03
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
125507279
1095072767
1235072715
10241
1105072753
126507271
122507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x481bbc56
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion8.0
SizeOfCode0x15000
SizeOfInitializedData0xb000
SizeOfUninitializedData0
AddressOfEntryPoint0x4033
BaseOfCode0x1000
BaseOfData0x16000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion6.0
ImageVersion6.0
SubsystemVersion4.10
Reserved10
SizeOfImage0x21000
SizeOfHeaders0x1000
CheckSum0x2e7b3
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x8000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x14fac0x15000R-X CODE
.data0x160000x4d40x1000RW- IDATA
.rsrc0x170000x7df00x8000R-- IDATA
.reloc0x1f0000x11740x2000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x29080x38
IMPORT0x14f080xa0
RESOURCE0x170000x7df0
EXCEPTION00
SECURITY00
BASERELOC0x1f0000x1174
DEBUG0x15f4c0x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xc5480x40
Bound_IAT0x2900xa8
IAT0x10000x334
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12240
TYPELIB#1206840
ICON#17440
STRING#11500
STRING#24480
STRING#3420
STRING#63380
STRING#12632380
STRING#1273700
STRING#1322560
STRING#1916120
STRING#1944320
STRING#20112160
STRING#2079160
STRING#2085300
STRING#2131680
STRING#219940
GROUP_ICON#1200
VERSION#19120
idlangstring
11033Windows Script Host
31033Windows Script Host (debugging disabled)
201033Windows Script Host Error
211033Windows Script Host Input Error
221033This Unicode version of Windows Script Host will only execute under Windows NT. Please use the ANSI version of Windows Script Host."
301033Usage:
311033 Options:
321033value
10011033wsh
20011033Windows Script Host
20031033Windows Script Host (debugging disabled)
20101033Usage: CScript scriptname.extension [option...] [arguments...] Options: //B Batch mode: Suppresses script errors and prompts from displaying //D Enable Active Debugging //E:engine Use engine for executing script //H:CScript Changes the default script host to CScript.exe //H:WScript Changes the default script host to WScript.exe (default) //I Interactive mode (default, opposite of //B) //Job:xxxx Execute a WSF job //Logo Display logo (default) //Nologo Prevent logo display: No banner will be shown at execution time //S Save current command line options for this user //T:nn Time out in seconds: Maximum time a script is permitted to run //X Execute script in debugger //U Use Unicode for redirected I/O from the console
20111033Usage: CScript scriptname.extension [option...] [arguments...] Options: //B Batch mode: Suppresses script errors and prompts from displaying //D Enable Active Debugging //E:engine Use engine for executing script //H:CScript Changes the default script host to CScript.exe //H:WScript Changes the default script host to WScript.exe (default) //I Interactive mode (default, opposite of //B) //Job:xxxx Execute a WSF job //Logo Display logo (default) //Nologo Prevent logo display: No banner will be shown at execution time //S Save current command line options for this user //T:nn Time out in seconds: Maximum time a script is permitted to run //X Execute script in debugger
20201033CScript Error
20211033Input Error
20221033This Unicode version of CScript will only execute under Windows NT. Please use the ANSI version of CScript."
20231033%1!ls!(%2!u!, %3!u!) %4!ls!: %5!ls!
21001033Microsoft (R) Windows Script Host Version %1!u!.%2!u! Copyright (C) Microsoft Corporation. All rights reserved.
30501033The Windows Script Host settings have been reset to default.
30511033Command line options are saved.
30521033The default script host is now set to "wscript.exe".
30531033The default script host is now set to "cscript.exe".
30541033Successful execution of Windows Script Host.
30551033Successful remote execution of Windows Script Host.
31001033Script execution time was exceeded on script "%1!ls!". Script execution was terminated.
31011033Could not locate automation class named "%1!ls!".
31021033Could not connect object.
31031033Could not create object named "%1!ls!".
32001033Initialization of the Windows Script Host failed.
32011033Can't find script engine "%2!ls!" for script "%1!ls!".
32021033Can't change default script host.
32031033An attempt at saving your settings via the //S option failed.
32041033Loading script "%1!ls!" failed (%2!ls!).
32051033Loading your settings failed.
32061033Execution of the Windows Script Host failed.
32071033Unexpected error of the Windows Script Host.
32081033Windows Script Host access is disabled on this machine. Contact your administrator for details.
32091033Attempt to execute Windows Script Host while it is disabled.
32101033Attempt to execute Windows Script Host remotely while remote execution is disabled.
33001033//T option requires timeout value.
33011033Invalid timeout value for //T option.
33021033Unknown option "%1!ls!" specified.
33031033Extra argument specified to option "%1!ls!".
33041033There is no script file specified.
33051033Command line option mismatch.
33061033There is no file extension in "%1!ls!".
33071033//H option requires host name.
33081033Host name for //H option must be "cscript" or "wscript".
33091033There is no script engine for file extension "%1!ls!".
33101033Can not find script file "%1!ls!".
33111033Invalid pathname.
33121033Need -E option.
33131033-E option requires name of script engine.
33141033Can't read script from stdin.
33151033//CP option requires code page value.
33161033Invalid code page value for //CP option.
33171033Missing job name.
33181033Unicode is not supported on this platform.
33191033Unable to find job "%1!ls!".
34001033Script setting file "%1!ls!" is invalid.
34011033Invalid #codepage directive.
35001033Win32 Error 0x%X
35011033%1!ls! (%2!ls!)
module_namehintordfunction_name
KERNEL32.dll546GetProcAddress
KERNEL32.dll927SearchPathW
KERNEL32.dll314FindResourceW
KERNEL32.dll629GetUserDefaultUILanguage
KERNEL32.dll584GetSystemDefaultUILanguage
KERNEL32.dll635GetVersionExW
KERNEL32.dll491GetLocaleInfoW
KERNEL32.dll125CreateFileMappingW
KERNEL32.dll760LoadLibraryExW
KERNEL32.dll313FindResourceExW
KERNEL32.dll763LoadResource
KERNEL32.dll1012SetLastError
KERNEL32.dll128CreateFileW
KERNEL32.dll469GetFileSize
KERNEL32.dll122CreateFileMappingA
KERNEL32.dll783MapViewOfFile
KERNEL32.dll1099UnmapViewOfFile
KERNEL32.dll537GetPrivateProfileIntW
KERNEL32.dll536GetPrivateProfileIntA
KERNEL32.dll543GetPrivateProfileStringW
KERNEL32.dll542GetPrivateProfileStringA
KERNEL32.dll480GetFullPathNameW
KERNEL32.dll477GetFullPathNameA
KERNEL32.dll489GetLocaleInfoA
KERNEL32.dll759LoadLibraryExA
KERNEL32.dll761LoadLibraryW
KERNEL32.dll681HeapReAlloc
KERNEL32.dll585GetSystemDirectoryA
KERNEL32.dll606GetTempPathA
KERNEL32.dll121CreateFileA
KERNEL32.dll322FlushFileBuffers
KERNEL32.dll626GetUserDefaultLCID
KERNEL32.dll703InterlockedCompareExchange
KERNEL32.dll706InterlockedExchange
KERNEL32.dll634GetVersionExA
KERNEL32.dll756LeaveCriticalSection
KERNEL32.dll218EnterCriticalSection
KERNEL32.dll705InterlockedDecrement
KERNEL32.dll709InterlockedIncrement
KERNEL32.dll115CreateEventA
KERNEL32.dll164CreateThread
KERNEL32.dll68CloseHandle
KERNEL32.dll987SetEvent
KERNEL32.dll502GetModuleFileNameW
KERNEL32.dll501GetModuleFileNameA
KERNEL32.dll333FreeLibrary
KERNEL32.dll1215lstrlenA
KERNEL32.dll191DeleteCriticalSection
KERNEL32.dll697InitializeCriticalSection
KERNEL32.dll758LoadLibraryA
KERNEL32.dll329FormatMessageW
KERNEL32.dll766LocalAlloc
KERNEL32.dll770LocalFree
KERNEL32.dll328FormatMessageA
KERNEL32.dll463GetFileAttributesW
KERNEL32.dll293FindFirstFileW
KERNEL32.dll458GetFileAttributesA
KERNEL32.dll286FindFirstFileA
KERNEL32.dll282FindClose
KERNEL32.dll339GetACP
KERNEL32.dll348GetCPInfo
KERNEL32.dll1055SetUnhandledExceptionFilter
KERNEL32.dll1096UnhandledExceptionFilter
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll550GetProcessHeap
KERNEL32.dll678HeapFree
KERNEL32.dll674HeapAlloc
KERNEL32.dll503GetModuleHandleA
KERNEL32.dll261ExitProcess
KERNEL32.dll369GetCommandLineW
KERNEL32.dll368GetCommandLineA
KERNEL32.dll799MultiByteToWideChar
KERNEL32.dll574GetStdHandle
KERNEL32.dll1216lstrlenW
KERNEL32.dll487GetLastError
KERNEL32.dll1174WriteConsoleW
KERNEL32.dll1175WriteFile
KERNEL32.dll1156WideCharToMultiByte
KERNEL32.dll604GetTempFileNameA
KERNEL32.dll406GetConsoleMode
KERNEL32.dll857QueryPerformanceCounter
KERNEL32.dll618GetTickCount
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll595GetSystemTimeAsFileTime
KERNEL32.dll831OutputDebugStringA
KERNEL32.dll922RtlUnwind
KERNEL32.dll1079TerminateProcess
msvcrt.dll974_vsnwprintf
msvcrt.dll895_swab
msvcrt.dll1376wcsrchr
msvcrt.dll563_itow
msvcrt.dll968_vsnprintf
msvcrt.dll176__mb_cur_max
msvcrt.dll475_iob
msvcrt.dll1262memset
msvcrt.dll1258memcpy
msvcrt.dll1260memmove
msvcrt.dll1246malloc
msvcrt.dll1190free
msvcrt.dll1017_wcsnicmp
msvcrt.dll1007_wcsicmp
msvcrt.dll1371wcsncmp
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll342_errno
msvcrt.dll1255mbtowc
msvcrt.dll1218isleadbyte
msvcrt.dll815_snprintf
msvcrt.dll561_itoa
msvcrt.dll1390wctomb
msvcrt.dll1172ferror
msvcrt.dll133__badioinfo
msvcrt.dll207__pioinfo
msvcrt.dll367_fileno
msvcrt.dll587_lseeki64
msvcrt.dll1096_write
msvcrt.dll478_isatty
msvcrt.dll1154bsearch
OLEAUT32.dll9
OLEAUT32.dll201
OLEAUT32.dll202
OLEAUT32.dll10
OLEAUT32.dll8
OLEAUT32.dll4
OLEAUT32.dll150
OLEAUT32.dll161
OLEAUT32.dll12
OLEAUT32.dll25
OLEAUT32.dll7
OLEAUT32.dll6
OLEAUT32.dll19
OLEAUT32.dll16
OLEAUT32.dll26
OLEAUT32.dll15
OLEAUT32.dll162
OLEAUT32.dll27
OLEAUT32.dll20
OLEAUT32.dll2
ole32.dll61CoInitialize
ole32.dll107CoUninitialize
ole32.dll37CoGetClassObject
ole32.dll211MkParseDisplayName
ole32.dll6CLSIDFromProgID
ole32.dll8CLSIDFromString
ole32.dll120CreateBindCtx
ole32.dll16CoCreateInstance
ole32.dll85CoRegisterMessageFilter
ole32.dll63CoInitializeSecurity
ole32.dll125CreateFileMoniker
VERSION.dll2GetFileVersionInfoSizeA
VERSION.dll13VerQueryValueW
VERSION.dll5GetFileVersionInfoW
VERSION.dll4GetFileVersionInfoSizeW
VERSION.dllGetFileVersionInfoA
VERSION.dll12VerQueryValueA
ADVAPI32.dll616RegQueryValueExW
ADVAPI32.dll563RegCreateKeyExW
ADVAPI32.dll562RegCreateKeyExA
ADVAPI32.dll603RegOpenKeyExW
ADVAPI32.dll365ImpersonateLoggedOnUser
ADVAPI32.dll378IsTextUnicode
ADVAPI32.dll637RegisterEventSourceW
ADVAPI32.dll351GetUserNameW
ADVAPI32.dll393LookupAccountNameW
ADVAPI32.dll649ReportEventW
ADVAPI32.dll215DeregisterEventSource
ADVAPI32.dll615RegQueryValueExA
ADVAPI32.dll584RegEnumKeyExA
ADVAPI32.dll561RegCreateKeyA
ADVAPI32.dll602RegOpenKeyExA
ADVAPI32.dll631RegSetValueExA
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll632RegSetValueExW
USER32.dll670SetTimer
USER32.dll149DefWindowProcA
USER32.dll544PostQuitMessage
USER32.dll461KillTimer
USER32.dll232EnumThreadWindows
USER32.dll676SetWindowLongA
USER32.dll542PostMessageA
USER32.dll606SendMessageA
USER32.dll518MsgWaitForMultipleObjects
USER32.dll539PeekMessageA
USER32.dll725TranslateMessage
USER32.dll168DispatchMessageA
USER32.dll341GetParent
USER32.dll266GetClassNameA
USER32.dll385GetWindowLongA
USER32.dll330GetMessageA
USER32.dll103CreateWindowExA
USER32.dll563RegisterClassA
USER32.dll260GetClassInfoA
USER32.dll249GetActiveWindow
USER32.dll45CharNextA
USER32.dll483LoadStringA
USER32.dll484LoadStringW
USER32.dll458IsWindowVisible
ordentry_vafunction_name
10x2945
module_namecscript.exe
flags0
timestamp2008-05-03 01:13:58
version0.0
ordinal_base1
nFunctions1
nNames0
Names(0)0
Functions(1)0x2930
NameOrdinals(0)0

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft (R) Console Based Script Host
FileVersion5.7.0.18066
InternalNamecscript.exe
LegalCopyrightCopyright (C) Microsoft Corp. 1996-2006, All Rights Reserved
OriginalFilenamecscript.exe
ProductNameMicrosoft (R) Windows Script Host
ProductVersion5.7.0.18066

VS_FIXEDFILEINFO

FileVersion5.7.0.18066
ProductVersion5.7.0.18066
StrucVersion0x10000
FileFlagsMask3
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0135168EXE05/03/2008 01:13:58#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x290
[?] can't find file_offset of VA 0x0