Deep Malware Analysis of 107b8ffa15fb8eb3bdb6ea5da160357b | md5: 107b8ffa15fb8eb3bdb6ea5da160357b | SOS: 0.24 | MSXML2.DOMDocument.6.0 | Scripting.FileSystemObject | WScript.Shell | MSXML2.XMLHTTP | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | VBS Execute Sub-Script | T1105 | T1059 | COM Behavior Trace | PowerShell | SOS: 0.36 | T1059.001 | SOS: 0.41 | SOS: 0.17 | SOS: 0.40 | SOS: 0.30

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	107b8ffa15fb8eb3bdb6ea5da160357b
Sha1	5fb48b9c2946581e8d6c159d3f055271e8dc8cd3
Sha256	1c6e53e93260fcb3d6a2f0ff0a5ec8e40434b6346d1e08c884902be30c91d05c
Sha384	66b5978b8234179a2e26e0d8e773f252c15565503daa0710b2404e317322575951a34e40f69bda398f25685b719b5ca8
Sha512	96ef294169e34f33c50cf4354f9275866f199a8303871f797b434036dc9c04fe99098322ce6f9240d9aca59a1c6f80df30ff5ca399e141699a46b8b1cee9484c
SSDeep	1536:cnXrW+DnRnRH/UOdz+LlBpL9Y7Tyze32n/SfZ+D0+MKXw7uduj1NCVuEmsx8me5f:mg1OX
TLSH	438384682244D0C3ABC53710F8EBBFE4A1647AE6BDDC478050244A51D7ADEE79C90B9F

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105

Shape scr:vbs>scr:ps1

malicious 2 nodes

Path scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005

Shape scr:vbs>scr:ps1

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 5huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 8huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 5huhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 6huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential