filenamecscript.exe
size126976 (0x1f000)
md5f36b7461fecdcf763fdefa3a3352cd45
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307299
1313072967
1473072915
10241
1323072953
126507271
146307291
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bc670
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x15400
SizeOfInitializedData0x9800
SizeOfUninitializedData0
AddressOfEntryPoint0x30e6
BaseOfCode0x1000
BaseOfData0x16000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.0
Reserved10
SizeOfImage0x22000
SizeOfHeaders0x400
CheckSum0x28539
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x8000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x153400x15400R-X CODE
.data0x170000x4d80x600RW- IDATA
.rsrc0x180000x7dd80x7e00R-- IDATA
.reloc0x200000x12080x1400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x2d4c0x38
IMPORT0x152a80xa0
RESOURCE0x180000x7dd8
EXCEPTION00
SECURITY00
BASERELOC0x200000x1208
DEBUG0x162e00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xca980x40
Bound_IAT0x2800xa8
IAT0x10000x330
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12240
TYPELIB#1206840
ICON#17440
STRING#11500
STRING#24480
STRING#3420
STRING#63380
STRING#12632380
STRING#1273700
STRING#1322560
STRING#1916120
STRING#1944320
STRING#20112160
STRING#2079160
STRING#2085300
STRING#2131680
STRING#219940
GROUP_ICON#1200
VERSION#18880
idlangstring
11033Windows Script Host
31033Windows Script Host (debugging disabled)
201033Windows Script Host Error
211033Windows Script Host Input Error
221033This Unicode version of Windows Script Host will only execute under Windows NT. Please use the ANSI version of Windows Script Host."
301033Usage:
311033 Options:
321033value
10011033wsh
20011033Windows Script Host
20031033Windows Script Host (debugging disabled)
20101033Usage: CScript scriptname.extension [option...] [arguments...] Options: //B Batch mode: Suppresses script errors and prompts from displaying //D Enable Active Debugging //E:engine Use engine for executing script //H:CScript Changes the default script host to CScript.exe //H:WScript Changes the default script host to WScript.exe (default) //I Interactive mode (default, opposite of //B) //Job:xxxx Execute a WSF job //Logo Display logo (default) //Nologo Prevent logo display: No banner will be shown at execution time //S Save current command line options for this user //T:nn Time out in seconds: Maximum time a script is permitted to run //X Execute script in debugger //U Use Unicode for redirected I/O from the console
20111033Usage: CScript scriptname.extension [option...] [arguments...] Options: //B Batch mode: Suppresses script errors and prompts from displaying //D Enable Active Debugging //E:engine Use engine for executing script //H:CScript Changes the default script host to CScript.exe //H:WScript Changes the default script host to WScript.exe (default) //I Interactive mode (default, opposite of //B) //Job:xxxx Execute a WSF job //Logo Display logo (default) //Nologo Prevent logo display: No banner will be shown at execution time //S Save current command line options for this user //T:nn Time out in seconds: Maximum time a script is permitted to run //X Execute script in debugger
20201033CScript Error
20211033Input Error
20221033This Unicode version of CScript will only execute under Windows NT. Please use the ANSI version of CScript."
20231033%1!ls!(%2!u!, %3!u!) %4!ls!: %5!ls!
21001033Microsoft (R) Windows Script Host Version %1!u!.%2!u! Copyright (C) Microsoft Corporation. All rights reserved.
30501033The Windows Script Host settings have been reset to default.
30511033Command line options are saved.
30521033The default script host is now set to "wscript.exe".
30531033The default script host is now set to "cscript.exe".
30541033Successful execution of Windows Script Host.
30551033Successful remote execution of Windows Script Host.
31001033Script execution time was exceeded on script "%1!ls!". Script execution was terminated.
31011033Could not locate automation class named "%1!ls!".
31021033Could not connect object.
31031033Could not create object named "%1!ls!".
32001033Initialization of the Windows Script Host failed.
32011033Can't find script engine "%2!ls!" for script "%1!ls!".
32021033Can't change default script host.
32031033An attempt at saving your settings via the //S option failed.
32041033Loading script "%1!ls!" failed (%2!ls!).
32051033Loading your settings failed.
32061033Execution of the Windows Script Host failed.
32071033Unexpected error of the Windows Script Host.
32081033Windows Script Host access is disabled on this machine. Contact your administrator for details.
32091033Attempt to execute Windows Script Host while it is disabled.
32101033Attempt to execute Windows Script Host remotely while remote execution is disabled.
33001033//T option requires timeout value.
33011033Invalid timeout value for //T option.
33021033Unknown option "%1!ls!" specified.
33031033Extra argument specified to option "%1!ls!".
33041033There is no script file specified.
33051033Command line option mismatch.
33061033There is no file extension in "%1!ls!".
33071033//H option requires host name.
33081033Host name for //H option must be "cscript" or "wscript".
33091033There is no script engine for file extension "%1!ls!".
33101033Can not find script file "%1!ls!".
33111033Invalid pathname.
33121033Need -E option.
33131033-E option requires name of script engine.
33141033Can't read script from stdin.
33151033//CP option requires code page value.
33161033Invalid code page value for //CP option.
33171033Missing job name.
33181033Unicode is not supported on this platform.
33191033Unable to find job "%1!ls!".
34001033Script setting file "%1!ls!" is invalid.
34011033Invalid #codepage directive.
35001033Win32 Error 0x%X
35011033%1!ls! (%2!ls!)
module_namehintordfunction_name
KERNEL32.dll581GetProcAddress
KERNEL32.dll1053SearchPathW
KERNEL32.dll670GetUserDefaultUILanguage
KERNEL32.dll622GetSystemDefaultUILanguage
KERNEL32.dll518GetLocaleInfoW
KERNEL32.dll676GetVersionExW
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll1139SetLastError
KERNEL32.dll833LoadResource
KERNEL32.dll333FindResourceExW
KERNEL32.dll143CreateFileW
KERNEL32.dll496GetFileSize
KERNEL32.dll137CreateFileMappingA
KERNEL32.dll855MapViewOfFile
KERNEL32.dll1238UnmapViewOfFile
KERNEL32.dll572GetPrivateProfileIntW
KERNEL32.dll571GetPrivateProfileIntA
KERNEL32.dll578GetPrivateProfileStringW
KERNEL32.dll577GetPrivateProfileStringA
KERNEL32.dll507GetFullPathNameW
KERNEL32.dll504GetFullPathNameA
KERNEL32.dll516GetLocaleInfoA
KERNEL32.dll829LoadLibraryExA
KERNEL32.dll831LoadLibraryW
KERNEL32.dll722HeapReAlloc
KERNEL32.dll623GetSystemDirectoryA
KERNEL32.dll644GetTempPathA
KERNEL32.dll642GetTempFileNameA
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll667GetUserDefaultLCID
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll748InterlockedExchange
KERNEL32.dll675GetVersionExA
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll130CreateEventA
KERNEL32.dll181CreateThread
KERNEL32.dll82CloseHandle
KERNEL32.dll1113SetEvent
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll354FreeLibrary
KERNEL32.dll1357lstrlenA
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll828LoadLibraryA
KERNEL32.dll350FormatMessageW
KERNEL32.dll836LocalAlloc
KERNEL32.dll840LocalFree
KERNEL32.dll349FormatMessageA
KERNEL32.dll490GetFileAttributesW
KERNEL32.dll313FindFirstFileW
KERNEL32.dll485GetFileAttributesA
KERNEL32.dll306FindFirstFileA
KERNEL32.dll302FindClose
KERNEL32.dll360GetACP
KERNEL32.dll370GetCPInfo
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll1048RtlUnwind
KERNEL32.dll586GetProcessHeap
KERNEL32.dll719HeapFree
KERNEL32.dll715HeapAlloc
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll281ExitProcess
KERNEL32.dll391GetCommandLineW
KERNEL32.dll390GetCommandLineA
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll612GetStdHandle
KERNEL32.dll1358lstrlenW
KERNEL32.dll514GetLastError
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll1317WriteFile
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll136CreateFileA
KERNEL32.dll428GetConsoleMode
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll659GetTickCount
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll905OutputDebugStringA
msvcrt.dll974_vsnwprintf
msvcrt.dll895_swab
msvcrt.dll1376wcsrchr
msvcrt.dll563_itow
msvcrt.dll968_vsnprintf
msvcrt.dll176__mb_cur_max
msvcrt.dll475_iob
msvcrt.dll1262memset
msvcrt.dll1258memcpy
msvcrt.dll1260memmove
msvcrt.dll1246malloc
msvcrt.dll1190free
msvcrt.dll1007_wcsicmp
msvcrt.dll1017_wcsnicmp
msvcrt.dll1371wcsncmp
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll342_errno
msvcrt.dll1255mbtowc
msvcrt.dll1218isleadbyte
msvcrt.dll815_snprintf
msvcrt.dll561_itoa
msvcrt.dll1390wctomb
msvcrt.dll1172ferror
msvcrt.dll133__badioinfo
msvcrt.dll207__pioinfo
msvcrt.dll367_fileno
msvcrt.dll587_lseeki64
msvcrt.dll1096_write
msvcrt.dll478_isatty
msvcrt.dll1154bsearch
OLEAUT32.dll202
OLEAUT32.dll201
OLEAUT32.dll9
OLEAUT32.dll10
OLEAUT32.dll8
OLEAUT32.dll4
OLEAUT32.dll150
OLEAUT32.dll161
OLEAUT32.dll12
OLEAUT32.dll25
OLEAUT32.dll7
OLEAUT32.dll6
OLEAUT32.dll19
OLEAUT32.dll16
OLEAUT32.dll26
OLEAUT32.dll15
OLEAUT32.dll162
OLEAUT32.dll27
OLEAUT32.dll20
OLEAUT32.dll2
ole32.dll62CoInitialize
ole32.dll108CoUninitialize
ole32.dll38CoGetClassObject
ole32.dll212MkParseDisplayName
ole32.dll6CLSIDFromProgID
ole32.dll8CLSIDFromString
ole32.dll121CreateBindCtx
ole32.dll16CoCreateInstance
ole32.dll86CoRegisterMessageFilter
ole32.dll64CoInitializeSecurity
ole32.dll126CreateFileMoniker
VERSION.dll3GetFileVersionInfoSizeA
VERSION.dll14VerQueryValueW
VERSION.dll6GetFileVersionInfoW
VERSION.dll5GetFileVersionInfoSizeW
VERSION.dllGetFileVersionInfoA
VERSION.dll13VerQueryValueA
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll371ImpersonateLoggedOnUser
ADVAPI32.dll384IsTextUnicode
ADVAPI32.dll643RegisterEventSourceW
ADVAPI32.dll357GetUserNameW
ADVAPI32.dll399LookupAccountNameW
ADVAPI32.dll655ReportEventW
ADVAPI32.dll219DeregisterEventSource
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll590RegEnumKeyExA
ADVAPI32.dll567RegCreateKeyA
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll638RegSetValueExW
USER32.dll699SetTimer
USER32.dll155DefWindowProcA
USER32.dll567PostQuitMessage
USER32.dll483KillTimer
USER32.dll239EnumThreadWindows
USER32.dll707SetWindowLongA
USER32.dll565PostMessageA
USER32.dll631SendMessageA
USER32.dll540MsgWaitForMultipleObjects
USER32.dll562PeekMessageA
USER32.dll764TranslateMessage
USER32.dll174DispatchMessageA
USER32.dll356GetParent
USER32.dll273GetClassNameA
USER32.dll405GetWindowLongA
USER32.dll345GetMessageA
USER32.dll109CreateWindowExA
USER32.dll587RegisterClassA
USER32.dll267GetClassInfoA
USER32.dll256GetActiveWindow
USER32.dll47CharNextA
USER32.dll505LoadStringA
USER32.dll506LoadStringW
USER32.dll480IsWindowVisible
ordentry_vafunction_name
10x2d89
module_namecscript.exe
flags0
timestamp2009-07-13 23:42:40
version0.0
ordinal_base1
nFunctions1
nNames0
Names(0)0
Functions(1)0x2d74
NameOrdinals(0)0

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft ® Console Based Script Host
FileVersion5.8.7600.16385
InternalNamecscript.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamecscript.exe
ProductNameMicrosoft ® Windows Script Host
ProductVersion5.8.7600.16385

VS_FIXEDFILEINFO

FileVersion5.8.7600.16385
ProductVersion5.8.7600.16385
StrucVersion0x10000
FileFlagsMask3
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0126976EXE07/13/2009 23:42:40#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280
[?] can't find file_offset of VA 0x0