Didier Stevens

Monday 9 June 2008

Quickpost: Embedding an Executable in a VBscript

Filed under: My Software,Quickpost — Didier Stevens @ 11:53

My latest bpmtk post got some people to ask me for the VBscript. I’ll do better, I’m posting the Python program I wrote to generate the script. You can download it here.

You have to provide it 2 arguments: the name of the executable to embed and the name of the VBscript to generate, like this:

file2vbscript cmd.exe cmd.vbs

This will generate a VBscript that will write cmd.exe to the current directory and execute it (create a new process). If you want to load a DLL in stead of executing an EXE, use the -l option:

file2vbscript -l mydll.dll mydll.vbs

And to use it in an Office application (Office VBA doesn’t take long subs), use the option -o:

file2vbscript -ol mydll.dll mydll.vbs

This will split the embedded file over several subs, to accommodate for the size limitation of Office VBscripts.

Quickpost info


  1. Very cool stuff, Didier!

    Comment by keydet89 — Wednesday 18 June 2008 @ 11:58

  2. Excuse my newbieness, but how do we embed the output vbscript inside an office file (VBA)?

    Comment by Anonymous — Monday 12 January 2015 @ 12:14

  3. Go to the developer menu and select VBA.

    Comment by Didier Stevens — Monday 12 January 2015 @ 14:45

  4. Awesome! Please how do I run the file2vbscript.py properly in command prompt? I keep getting the error below:

    File “C:\Demo\file2vbscript.py”,line 42, in Main

    infile = open
    IOError: [Errno 2] No such file or directory: ‘myfilename.exe’

    Please what am I doing wrong? Please help. Thank you.

    Comment by Sammy — Wednesday 26 August 2015 @ 14:24

  5. @Sammy what is your command?

    Comment by Didier Stevens — Friday 28 August 2015 @ 10:34

  6. C:\Python27\python.exe C:\Demo\file2vbscript.py -o myfile.exe myfile.vbs

    I await your reply. Thanks.

    Comment by Sammy — Friday 28 August 2015 @ 20:00

  7. @Sammy The command did not find your myfile.exe. Did you copy it in your working folder?

    Comment by Didier Stevens — Friday 28 August 2015 @ 21:26

  8. Yes, I did. I copied 2 files; file2vbscript.py and myfile.exe in Demo folder. Please what could be wrong?

    Comment by Sammy — Friday 28 August 2015 @ 22:52

  9. @Sammy and you are in the c:\demo folder? e.g, you typed cd c:\demo?

    Comment by Didier Stevens — Saturday 29 August 2015 @ 9:37

  10. Thanks. I figured it out. Is it possible to silent the Security Warning: Macros have be disabled Enable Content in Office when document is opened? I want the vbscript to execute the moment Office document is opened. Can this be achieved? Thanks again.

    Comment by Sammy — Saturday 29 August 2015 @ 17:31

  11. @Sammy Yes, that’s simple, you configure MS Office to enable macros. Google can help you with that.

    Comment by Didier Stevens — Saturday 29 August 2015 @ 22:02

  12. Please I need your help on how to reduce the output size of the VBS. My .exe file size is 1.3-1.5MB. Whenever I embed my .exe file, the VBS output size is around 5.2-6MB. Please help me reduce output size to around 2.5-3MB? I impatiently await your reply. Thank you.

    Comment by Sam — Saturday 23 April 2016 @ 16:18

  13. I can not make the vbs smaller. You have to make your exe smaller.

    Comment by Didier Stevens — Sunday 24 April 2016 @ 17:14

  14. Thank you for the reply. Do you know of any program that can make my exe smaller?

    Comment by Sam — Sunday 24 April 2016 @ 17:18

  15. UPX

    Comment by Didier Stevens — Sunday 24 April 2016 @ 18:09

RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Blog at WordPress.com.