WSF files are XML files with embedded scripts (in various languages but usually it's just a container for one script in one language, JS or VBS)
libmagic recognizes such files as XML 1.0 document, ASCII text, with very long lines (1113), with CRLF line terminators
If we combine XML in libmagic output with detection of well-known keywords from VBS/JS, we may classify file as WSF with pretty high confidence.
WSF files are XML files with embedded scripts (in various languages but usually it's just a container for one script in one language, JS or VBS)
libmagic recognizes such files as
XML 1.0 document, ASCII text, with very long lines (1113), with CRLF line terminatorsIf we combine XML in libmagic output with detection of well-known keywords from VBS/JS, we may classify file as WSF with pretty high confidence.