1
2
3
4
5 import os
6
7 from lib.common.abstracts import Package
8 from lib.api.process import Process
9 from lib.common.exceptions import CuckooPackageError
10
11
12
13
15 """VBS analysis package."""
16
18 paths = [
19 os.path.join(os.getenv("SystemRoot"), "system32", "wscript.exe")
20 ]
21
22 for path in paths:
23 if os.path.exists(path):
24 return path
25
26 return None
27
29 wscript = self.get_path()
30 if not wscript:
31 raise CuckooPackageError("Unable to find any WScript "
32 "executable available")
33
34 dll = self.options.get("dll", None)
35 free = self.options.get("free", False)
36 suspended = True
37 if free:
38 suspended = False
39
40 p = Process()
41 if not p.execute(path=wscript, args="\"{0}\"".format(path), suspended=suspended):
42 raise CuckooPackageError("Unable to execute initial WScript "
43 "process, analysis aborted")
44
45 if not free and suspended:
46 p.inject(dll)
47 p.resume()
48 return p.pid
49 else:
50 return None
51
54
56 if self.options.get("procmemdump", False):
57 for pid in self.pids:
58 p = Process(pid=pid)
59 p.dump_memory()
60
61 return True
62