Malicious
Malicious

1033376328b80ebddea337cdee483191

VBScript
|
MD5: 1033376328b80ebddea337cdee483191
|
Size: 9.3 KB
|
text/vbscript

Print
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
1033376328b80ebddea337cdee483191
Sha1
4aea3f09a1ac9ac05c745a747624a4f0d199c6a4
Sha256
18f79e4032e8ad64ac4c25aed4f2e9e6e510582d45a6126b9184a307a9ca480a
Sha384
54dfb8bf1d68fc9348056a01dd3e5ffe916b210bd4c6ff93a67af633782bc143617b9afbdf73687a551bf47eaeeef804
Sha512
404bfb76c8cef5000e3199c824f39baab28da9a145ecb206a86995dd5ab2440c1e4873d17339e8d0dc077f3d5ebd6849f003a575cb0ad124d6d2a9b0ddfa8f18
SSDeep
96:nzu5qS14mdUJjxNF8QhdV4xGXHPxEkkVtNQIG7jsBE/98VtNQIGLzcJEAxmVtNQL:zUKljhKiIc7jszcLzcBIcLzcjTWTUc
TLSH
B2124356DD74CEC486AF76A405683C1A2495222783605D69FCCC49CC3F2933AEF693CC
File Structure
1033376328b80ebddea337cdee483191
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Base64-Block@0x00000F24]
Artefacts
Name
 Value
Deobfuscated PowerShell

@(0, [Unmanaged(ErrorExpressionAst)] ,) true end "If" end "If" [Unmanaged(ErrorStatementAst)] if not "fso.FileExists" (flagpath) "Then" showerr closewin end "If" end "If" end "If" createpathfileintemp window.sleep 1 end "If" end "Sub" < "/script>" < "script" "language=JavaScript>" window.onload "=" "function" ([Unmanaged(ErrorStatementAst)] ) settimeout @("Pwn()", 100) [Unmanaged(ErrorStatementAst)] function sleep( seconds [Unmanaged(ErrorStatementAst)] var start "=" "new" "Date" ([Unmanaged(ErrorStatementAst)] )."getTime"() while (new "Date" ([Unmanaged(ErrorStatementAst)] )."getTime"() "-" "start" "*" 1000) { } [Unmanaged(ErrorStatementAst)] function showJSError( message alert (message) window.status "=" "Error: " "+" "message" function closeWin() window.close ([Unmanaged(ErrorStatementAst)] ) < "/script>" < "/body>" < "/html>"
Deobfuscated PowerShell

@(0, [Unmanaged(ErrorExpressionAst)] ,) true end "If" end "If" [Unmanaged(ErrorStatementAst)] if not "fso.FileExists" (flagpath) "Then" showerr closewin end "If" end "If" end "If" createpathfileintemp window.sleep 1 end "If" end "Sub" < "/script>" < "script" "language=JavaScript>" window.onload "=" "function" ([Unmanaged(ErrorStatementAst)] ) settimeout @("Pwn()", 100) [Unmanaged(ErrorStatementAst)] function sleep( seconds [Unmanaged(ErrorStatementAst)] var start "=" "new" "Date" ([Unmanaged(ErrorStatementAst)] )."getTime"() while (new "Date" ([Unmanaged(ErrorStatementAst)] )."getTime"() "-" "start" "*" 1000) { } [Unmanaged(ErrorStatementAst)] function showJSError( message alert (message) window.status "=" "Error: " "+" "message" function closeWin() window.close ([Unmanaged(ErrorStatementAst)] ) < "/script>" < "/body>" < "/html>"
1033376328b80ebddea337cdee483191 (9.3 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙