Malicious
VBScript
MD5: 07f892bc1092ef382131416551b6ab5c
Size: 965.03 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
965.03 KB · 965,032 B
First seen
2026-08-14 12:31 · 2 months ago
Last seen
2026-08-14 12:31 · 2 months ago
Last analysis
2026-08-14 14:44 · 2 months ago
Hashes
MD5
07f892bc1092ef382131416551b6ab5c
Sha1
eedc1af2facc239a235005b0dae69233e7097dc6
Sha256
cadf283eb0ce75f0907bac1c60dbdc89ead2e98eb8ec929353c24f420cfc1a17
Sha384
66d58a8dbc8da4bc7a3a7d221bc1fc040db65d6ca513144d5e19a515e1d7b5dbfb0931b3acf45d9323c739cb14665357
Sha512
a64faff9641c575addae420f797911776b7a25710179a596457f9a6ed715d21eeebe4e80f72315524350921b0188b4c088f349d39f8e9eb82f4076f491abcd0a
SSDeep
768:e2RVNhVpULxI0um/kPGm6QistRC+CAeFTJkDZWwfbtaEz5ESLNH98Gdgfs4CnU+x:Hr
TLSH
24258962C6CD4BB065F09E3DAB3A1D8B97E1792C90816E0F4F5D11F56D28FEA4E43089
7 malicious · 8 files
VBS07f892bc1092ef382131416551b6ab5cT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN07f892bc1092ef382131416551b6ab5c.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1059.005>scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1059.005
Shape
scr:vbs>scr:ps1>scr:vbs
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential