← All detection heuristics · Script
critical
WINDOWS_SCRIPT_BASE64_BINARY_DROPPER
What it means
WSH/JScript uses XMLDOM Base64 conversion and ADODB.Stream with a large embedded blob.
Why it fires
The conjunction of ActiveX/WSH object creation, binary Base64 conversion, ADODB.Stream and a large encoded payload identifies an embedded binary dropper.
Other Script heuristics
SCRIPT_WSH_OBFUSCATED WINDOWS_PS_ADDTYPE_WINAPI_TAMPER LNK_POWERSHELL_BIGINT_NETWORK_ENDPOINT WINDOWS_PS_SCREENSHOT_UPLOAD_EXFIL WINDOWS_SCRIPT_CERTUTIL_RUNDLL_CHAIN SCRIPT_WSH_STREAM_WRITE_RUN_CHAIN WINDOWS_SCHEDULED_TASK_SCRIPT_EXEC LNK_SCRIPT_DOWNLOADER MACOS_ZSH_LOADER SCRIPT_HEAVY_STRING_DECODER_OBFUSCATION SCRIPT_WSH_MASQUERADE LNK_HIDDEN_SCRIPT_EXEC