#VBScript

Excited to share that while working @AirbusCERT ❤, I was fortunate enough to write a #VBScript/VBA #deobfuscator proto, based on partial evaluation and powered by ANTLR, C# and .Net Standard. vbSparkle was released yet 5 months ago ☞ #vbs #deobfuscator

#hta with plain #VBScript -> #bitsadmin (VT 3/58) 159355ff86aed19de50f3e78800f3749030f832521a93c2460a8dcca43d3c4e2 #njrat https[://filetransfer.io/data-package/yovW0lpr/download

#interesting #VBScript dls #vbs (sensitive 2 params & headers; returns a benign bitly url if they don't match) hxxp://blogrevendedores.info/?join=hugv4& #benign 2nd stage: hxxps://pastebin.com/wDNdm5Uk targeting #brazil & #chrome

ファイル名を日付付でリネームする #VBScript 。 こういうの作っておくと便利だよね。

ファイルをドラッグ＆ドロップするとファイル名をXXX_yyyy-MM-dd_ hh-mm-ssにするVBScriptってもしかして需要ある？

We all know that VBScript has been deprecated and will be removed in future Windows releases. The PowerShell OSLicense module helps you activate licenses, query them, and more. In this blog post, I will show you how it works #PowerShell #SLMGR #VBScript

Windows #VBScript deprecation appears on the horizon. Let's see who and what still uses VBScript in your environments thanks to Microsoft Defender XDR & some KQL:

Unique Infection vector xls -> Excel 4.0 -> mshta -> Dropbox url -> hta -> VBScript -> PowerShell -> Dropbox url -> exe New blog post : Excel 4.0 Macro, hta, #VBScript & #PowerShell Analysis – #Ataware #Ransomware Part 1 #Deobfuscate #MalwareAnalysis

Using #VBScript to run BIOS updates in SCCM: #VisualBasic #Microsoft

Cerbero Suite: The Hacker’s Multitool Excited to share this guest blog from @cprofiler Follow along with the analysis of heavily obfuscated #VBScript found within this #maldoc @erikpistelli @Anti_Expl0it @Ledtech3 @BouncyHat

微软公布 #VBScript 动态脚本语言的淘汰时间表：将在 2027 年后的某个时间彻底删除该脚本引擎。 VBS 早已停止发布新版本，但微软仍然提供安全更新，近 5 年利用 VBS 的黑客越来越多，微软已经心累所以决定还是淘汰吧，毕竟使用率极低。 查看全文：

An update on disabling #VBScript in #InternetExplorer11 #IE11 #Windows10

Interesting #hta contains #VBScript & #JScript code. #JS instantiate System.Runtime.Serialization.Formatters.Binary.BinaryFormatter (.NET obj, COM visible) to load serialized obj containing .net binary (See it in ILSpy) Soon we write a blog, stay tuned

VBScriptのサンプルが120超えました！ 是非ご利用下さい！ #VBScript #プログラミング初心者と繋がりたい #駆け出しエンジニアと繋がりたい

💥CHECK OUT THIS BLOG POST! Fixing VBScript Support in Windows ADK SEP 2023 Update (Build 25398) 👨‍💻 This post covers a temporary workaround until Microsoft releases an official fix! #VBScript #WindowsADK #WIndows11 More blogs HERE:

Digging into some VBScript -> .NET DLL -> EXE to find NETWIRE, in classic casual long-form content ;) With some special love to our friends at @snyksec to help spread the word The Big Fix event! Premieres 12:00 PM ET. #malware #vbscript #threatintel #ioc

Hey #PowerShell People, did you hear? #VBScript is dead. Long live #PowerShell!

"Yo, why are #JavaScript and its ecosystem so messy?!" 😡 Well, I am glad you asked... Let me tell you a story! 🤓 🧵👇

@BrendanEich I was 8 at the time, so my first encounter with #JavaScript was probably about 6-7 years later when I started to play around with #Frontpage and #DreamWeaver... I remember being confused by JS & its evil twin brother #JScript! They looked almost identical, but not really 😢

@BrendanEich JScript was an attempt by #Microsoft to reverse engineer and re-implement #JavaScript and make it available for Internet Explorer (which also supported #VBScript, a scripting language based on #Basic) 😵 My first prog language was #qBasic, so VBS was actually easier for me! 😀

#malicious #VBScript with lots of junk literal strings for distraction -> decodes & execs the second layer #code -> downloads & execs a #PE from hxxp://evolaw.ru/wp-content/uploads/2019/03/masquare.php #vbs #pe

#VBScript utilizes #bitsadmin to dl #PE (seems to be #qbot) hxxp://proto.thriftyhealthyandhappy.com/scintillating.png hxxp://ank.tastywieners.com/ubiquitous.png hxxp://horse.tastywienersonwheels.com/nouveau-riche.png hxxp://old.oshkoshrugby.com/caustic.png url + ?bg=sp39&os=&av=

Open-sourcing vbeDecoder today. This lib, written in C# (.netstandard and cross-platform) allows to decode #VBE (#VBScript Encoded) and #JSE (JScript #Encoded) scripts. It's not a huge novelty, but first .net implementation AFAIK. #malware #dfir