Deep Malware Analysis of 0cfe38cdad93599d146837e75c345703 | md5: 0cfe38cdad93599d146837e75c345703 | WScript.Shell | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | PowerShell | Batch Command | PowerShell Call | T1059 | COM Behavior Trace | T1059.001 | T1105

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	0cfe38cdad93599d146837e75c345703
Sha1	31fade7434cc41b87a7d00040ed61800a567d99c
Sha256	de976a48fc0a6d712682c3f1d3740d185182a80e514b272afe7cd733ad6208ca
Sha384	ef7bac70b48c3d33837e472bf31a5689e486639b9f84e55ab78ec9d7725ee13ac082a13d27cfc1582b56f5cb9c6a1b6d
Sha512	ef1c4d73bc1193e8cb075356d231e93aacc2327bbd8e2391d6e426bc8bfe109d8adcb8d43b2e0f2c2e8767ad7235432cb98058f8398d03021c15c3228c91ac45
SSDeep	6:j+q9NqcN7fBMbHTnc0JHsLlnc4KFrFHJh5kHibrFHJhrz+OLXHsL0yJHnHsLbn:KqacN140L1AFHJh5pFHJhnL8LtiLb
TLSH	ABE092EF15064CB3F54A95C8F6B6A949479D7D4464D77D76C6C4CC110108C70A223BC8

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001~T1105

Shape scr:vbs>scr:bat>scr:ps1

malicious 3 nodes

Config. Field	Value
URL (COM trace) #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL (COM trace) #2	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

cmd /chuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Removehuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential