Malicious
0e5f5826c38d92fd86cc88538ee04681
VBScript
MD5: 0e5f5826c38d92fd86cc88538ee04681
Size: 78.46 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 0e5f5826c38d92fd86cc88538ee04681 |
| Sha1 | 1238249428e66aece4a091a62891fa52f3228cb7 |
| Sha256 | ed971bcfc5a9eebfbecc9aab050ffb9e6d9cfe38a72fd6f74cfec39cbd31475f |
| Sha384 | 9b6ee140a33d836fa524405d161f71f68c77efb32bb4ac47abf4514b5b11ee9a75d3c5f83e15dac71a114a8c2a8e6567 |
| Sha512 | 6051ad29d0c440d37f9ee1333410feefd6c4884aed010f00a003f0998266ce33289783bba4142ee051baa83aeb5a9783c07c830d71cae30e4868ca5668fddaa5 |
| SSDeep | 768:gqFlN3ThDG1WMNUq+H+uYFD0DH3K/DGmb/am/A37LfIgYRhg7/31qEGn:gqFL+WMNUqk8FD0DH38bym437/chn |
| TLSH | 2D7364FA36550301CE29729736B23A05E87DA0FC9A5946AD5C89B1FFA025F334CF7684 |
Malicious
Malicious
Malicious
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$null huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$null huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
Malicious
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
0e5f5826c38d92fd86cc88538ee04681
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
0e5f5826c38d92fd86cc88538ee04681 › 0e5f5826c38d92fd86cc88538ee04681.deobfuscated.vbs › [Command #0]
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
0e5f5826c38d92fd86cc88538ee04681 › 0e5f5826c38d92fd86cc88538ee04681.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
0e5f5826c38d92fd86cc88538ee04681 › 0e5f5826c38d92fd86cc88538ee04681.deobfuscated.vbs › [Command #0] › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
$null huhuhuhuhuhuhuhuhuhuhu
0e5f5826c38d92fd86cc88538ee04681 › 0e5f5826c38d92fd86cc88538ee04681.deobfuscated.vbs › [Command #0] › [Base64-Block]
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
0e5f5826c38d92fd86cc88538ee04681 › 0e5f5826c38d92fd86cc88538ee04681.deobfuscated.vbs › [Command #0] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
$null huhuhuhuhuhuhuhuhuhuhu
0e5f5826c38d92fd86cc88538ee04681 › 0e5f5826c38d92fd86cc88538ee04681.deobfuscated.vbs › [Command #0] › [Base64-Block] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
0e5f5826c38d92fd86cc88538ee04681 › 0e5f5826c38d92fd86cc88538ee04681.deobfuscated.vbs › [Command #0] › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.