WinDBG and Java Script Analysis
Summary: Cisco Talos's Paul Rascagneres describes using WinDBG to trace how JavaScript objects like Shell.Application, Wscript.Shell, MSXML2.XMLHTTP, and eval() resolve to libraries such as shell32.dll, wshom, and jscript, then setting breakpoints to capture their arguments. The write-up shows retrieving arguments from the RCX register, accounting for a 0x18 offset when the argument is a SHELLEXECUTEINFO structure, and breaking on jscript!COleScript::Compile to recover both a plain calc.exe call and a base64-decoded notepad.exe call.
What you should know: The same eval() path that runs calc.exe in the example also decodes and executes base64-encoded commands, so an analyst who can break on jscript!COleScript::Compile sees the real payload rather than the obfuscated string.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026