Malicious
VBScript
MD5: 171a7aa59f860bd850791943151a0728
Size: 625.29 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score
Low
| MD5 | 171a7aa59f860bd850791943151a0728 |
| Sha1 | dea42af2c131a0f5af4902498b99b67bc3109574 |
| Sha256 | 9af4e75bc2a2875667ba022c443b15fc2df4238dc44280723dad13d6aa76505e |
| Sha384 | 7f0e5da99cad4a0dd6f44884e83ca92a61d098e82b55d0960b27294e18eaddebd440b56b51b992e5fd9f6b198c63b89b |
| Sha512 | d191fba98442087e53b3f61dac11f5813de99933f852ad6fca72e3fc2a61d985d4c37a4cf5744db4925d63769c306e82e20f5292b8512b4146b397f3a42bc754 |
| SSDeep | 192:VuFJ8WL71KF59uhEhwouUB3aP8+M1COsheK0ctt8iBItHZe:g0ctc9Ze |
| TLSH | 3AD49711092424E75CB21E8F344FBAF7E42D01DB751ADB0E6E6A7AEBCAD3D8023155D2 |
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:bat~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential