Malicious
Malicious

09b65c292e35268eede38d4c4490cbdf

VBScript
MD5: 09b65c292e35268eede38d4c4490cbdf
Size: 57.63 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan

This sample is a 56.3 KB VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 9 embedded or derived files. It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9f72c50f8e66727f7589f24254b006c43cd51ba2207a56fc008e399ccca49127
MD5
09b65c292e35268eede38d4c4490cbdf
Verdict
Malicious
File type
VBScript · 56.3 KB

Cite this report: https://app.malva.re/sha256/9f72c50f8e66727f7589f24254b006c43cd51ba2207a56fc008e399ccca49127

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
57.63 KB · 57,632 B
First seen
2026-11-02 13:45 · 6 hours ago
Last seen
2026-11-02 13:45 · 6 hours ago
Last analysis
2026-11-02 13:46 · 6 hours ago
Hashes
MD5 09b65c292e35268eede38d4c4490cbdf Sha1 c628c0538eb0ac6941ce615d3dd352e3a9a3b0e4 Sha256 9f72c50f8e66727f7589f24254b006c43cd51ba2207a56fc008e399ccca49127 Sha384 cc3ee1db5bea46a1472bd9cb31fedffa70559b5ef5d67b54eeecb01049d896ea67d81d9a9d99d5bdc24e5f0549ab3ce9 Sha512 33e8d31211ad903c5e1a1f83b560313a4d533db5e8a02d8055a91c074fdaee2d8601987cbfa2b78c893ea44b816babd5ddbbd66ee0ccc6120f0f7c9851c6fcd1 SSDeep 768:csRx4rgk00EdlDh5iIqlNrP7zjlTW1/GbNn9jO/f1hUh3V85/MLn0:csX0qTEjrPpC8B9sv4VSk0 TLSH 6043E470E9312F2C0D7AD6AAD84B07E4C5294C150D024C687EFBB25A14F677CA7BB61B
Detection
Symbol obfuscation
Medium

5 malicious · 6 files
VBS09b65c292e35268eede38d4c4490cbdf
VBS09b65c292e35268eede38d4c4490cbdf.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
BIN[Base64-Block]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:ps1
malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

5 malicious · 6 files
VBS09b65c292e35268eede38d4c4490cbdf
VBS09b65c292e35268eede38d4c4490cbdf.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
BIN[Base64-Block]
No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
09b65c292e35268eede38d4c4490cbdf
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙