Malicious
VBScript
MD5: 1feea0cd98782c360bccb06de3dba76b
Size: 1.17 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
1.17 MB · 1,168,943 B
First seen
2026-07-22 08:46 · 3 months ago
Last seen
2026-07-22 08:46 · 3 months ago
Last analysis
2026-07-23 16:23 · 3 months ago
Hashes
MD5
1feea0cd98782c360bccb06de3dba76b
Sha1
43d4c1256cb09868d86a702571d19d09b78c6a87
Sha256
0316a0534beb4e367a15ed8406c1ad712969211d0dc58bffa8cf2948768c888d
Sha384
941f39924e46c67cb6bb21f8996a62908024c469ad5bc0e63dd92505df05c02d36540e8cea1ef38667564eac5f913fcd
Sha512
15f48a648374902afea97db011708d0b781affd264de26655ab002ef682fbef162b3710af33dc4ffcec0a9798c4c7b9efa10934985ab90acd4e0ecb71859d07d
SSDeep
384:CoHx5TZO/Xku/iOk+ykpFejktnAAPkjpFe/kN/O5OIjktyx5TZO/XkJFkc/IOnA+:/B3ruorlpTCo2+e0ma1Jml
TLSH
0945548FA351FB465C9B26831506B4D7285DCC62526B3C4DFE38B9C9F800741E2BEA5B
11 malicious · 12 files
VBS1feea0cd98782c360bccb06de3dba76bT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN1feea0cd98782c360bccb06de3dba76b.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
SH[Command #1] T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential