Malicious
0cfe38cdad93599d146837e75c345703
VBScript
MD5: 0cfe38cdad93599d146837e75c345703
Size: 379 B
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 0cfe38cdad93599d146837e75c345703 |
| Sha1 | 31fade7434cc41b87a7d00040ed61800a567d99c |
| Sha256 | de976a48fc0a6d712682c3f1d3740d185182a80e514b272afe7cd733ad6208ca |
| Sha384 | ef7bac70b48c3d33837e472bf31a5689e486639b9f84e55ab78ec9d7725ee13ac082a13d27cfc1582b56f5cb9c6a1b6d |
| Sha512 | ef1c4d73bc1193e8cb075356d231e93aacc2327bbd8e2391d6e426bc8bfe109d8adcb8d43b2e0f2c2e8767ad7235432cb98058f8398d03021c15c3228c91ac45 |
| SSDeep | 6:j+q9NqcN7fBMbHTnc0JHsLlnc4KFrFHJh5kHibrFHJhrz+OLXHsL0yJHnHsLbn:KqacN140L1AFHJh5pFHJhnL8LtiLb |
| TLSH | ABE092EF15064CB3F54A95C8F6B6A949479D7D4464D77D76C6C4CC110108C70A223BC8 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001~T1105
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
0cfe38cdad93599d146837e75c345703
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
0cfe38cdad93599d146837e75c345703
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
0cfe38cdad93599d146837e75c345703
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
0cfe38cdad93599d146837e75c345703
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
0cfe38cdad93599d146837e75c345703 › 0cfe38cdad93599d146837e75c345703.comtrace › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.