Malicious
0703489d3a6f7091236b105fb89165f6
VBScript
MD5: 0703489d3a6f7091236b105fb89165f6
Size: 62.68 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 61.2 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 8 embedded or derived files. It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- ca3b0bc21b24136080dc2d869966bfc23befc6b5dd495c48878a3cb1ba6cccf1
- MD5
- 0703489d3a6f7091236b105fb89165f6
- Verdict
- Malicious
- File type
- VBScript · 61.2 KB
Cite this report: https://app.malva.re/sha256/ca3b0bc21b24136080dc2d869966bfc23befc6b5dd495c48878a3cb1ba6cccf1
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
62.68 KB · 62,677 B
First seen
2026-11-02 13:45 · 6 hours ago
Last seen
2026-11-02 13:45 · 6 hours ago
Last analysis
2026-11-02 13:46 · 6 hours ago
Hashes
MD5
0703489d3a6f7091236b105fb89165f6
Sha1
902f533b21ff463d6244401840dee79e00156e39
Sha256
ca3b0bc21b24136080dc2d869966bfc23befc6b5dd495c48878a3cb1ba6cccf1
Sha384
fa91fb22d42d5db4af3544d45b9be2e07a51015b4d0147be69c749ee0d95c15dc7118f8392c43bef13d541d95aa243dd
Sha512
aafc2b5d84a45ad03699629dd7e8db75745f404233c4bce95c605d50185a53984deb6b2649da516fea74d5b7cc01f6e68ebe2fe8ddad40397ea5108da450caf3
SSDeep
768:cscx41QmK0MfT4cGcps76LSHYFtJZ1SAiU+vnE9RD0KlkpznP:csgolK0srpsmLVtJqe2pP
TLSH
C3536C5E9A257D10BCCEE69597E4052BFCA4C1183D0E307C298B721D2E061F8B66EDF6
Detection
Symbol obfuscation
Medium
5 malicious · 6 files
VBS0703489d3a6f7091236b105fb89165f6T1027 · T1059.001 · T1059.005
VBS0703489d3a6f7091236b105fb89165f6.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential5 malicious · 6 files
VBS0703489d3a6f7091236b105fb89165f6T1027 · T1059.001 · T1059.005
VBS0703489d3a6f7091236b105fb89165f6.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
0703489d3a6f7091236b105fb89165f6
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account