File VBE

.vbe files are closely related to VBScript - a scripting language based on Microsoft's Visual Basic. A .vbe file is a script file written in VBScript that has been passed through Microsoft's Script Encoder (screnc.exe). The file stores the script's source code in encoded form so that it cannot be directly read or edited; the encoding is a reversible obfuscation rather than true encryption. .vbe files are executed by Windows Script Host (wscript.exe or cscript.exe) and are only supported on Windows operating systems.

Encoded .vbe files are identifiable by the distinctive delimiters #@~^ (opening) and ^#~@ (closing) that wrap the obfuscated payload along with a length checksum - there is no binary magic number.

.vbs is the plain-text equivalent used in the Visual Basic Script environment. The main difference between those two formats lies in encoding - a .vbe file is encoded, whereas a .vbs is not. The same Script Encoder tool also produces .jse files, the encoded counterpart for JScript. Both encoded formats can be embedded inside a .wsf Windows Script File.

.vbe files are commonly used by malicious actors as a means of distributing malware via email, since the encoding obscures the payload from casual inspection. Opening unknown attachments containing a .vbe file should be handled with the utmost caution. More advanced users may decode and inspect the source code using a community decoder script - such as a Decode.vbs utility - before executing anything.