Malicious
25df8c46e6c294d62702eeb6d8a228d8
VBScript Encoded
MD5: 25df8c46e6c294d62702eeb6d8a228d8
Size: 1.16 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.16 MB · 1,164,921 B
Hashes
MD5
25df8c46e6c294d62702eeb6d8a228d8
Sha1
3040a1c5b725855cd5c942a21a7bbb0840af40bb
Sha256
a8eb68ed1d443959b4e0b4d66886ce01192d989b0c9016a32d9ab705cb4e8269
Sha384
5475728cc92156e62c997090bdabd95afe86516e6411164b53c7a3ecc5d48b0d2501779618fd7f09d20e2d8d1ddb7e22
Sha512
82cbfc88c740a1adb4d80fcb989355c0155a75e90faae0db44579d4a2dfaa8a6cb5d57d466266ffc942bb189c24efd1764ff33e427417be18cd7a1b27d1956e1
SSDeep
24576:U2G/nvxW3Ww0t7fSykY5JdXYAhbVba6jAkmk30IgYuvm:UbA307fSqJd3r730/+
TLSH
90454A017E44CA12F0191633C2FF4A044BB4AC51AAA6E72B7EF9376E55123937D1DACB
Detection
PeID
HQR data fileMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
5 malicious · 35 files
VBS25df8c46e6c294d62702eeb6d8a228d8T1027 · T1059 · T1059.005
Structure
VBSOverlay_2561e27d.bin
BATKNsmy0symRzwjjZVDkmmozpp.bat
EXEreviewCrt.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BIN.Net Resources
BINSA0d7uL4r3IU5WIcYC.Ycng6baCdAAb2F2nI1
BINVHT18itow3g6kFuT9S.d6No4yga9DeMon5g0Q
VBSjSaqJlIaXrpMVGLICLmiWYm.vbe
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
VBS25df8c46e6c294d62702eeb6d8a228d8.decoded.vbsT1027 · T1059 · T1059.005
VBS25df8c46e6c294d62702eeb6d8a228d8.decoded.vbs.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
7 / 7
Path
pe:exe>scr:vbe>pe:exe>pe:rsrc>bin
Shape
pe:exe>scr:vbe>pe:exe>pe:rsrc>bin
malicious
5 nodes
Path
pe:exe>scr:vbe>pe:exe>bin
Shape
pe:exe>scr:vbe>pe:exe>bin
malicious
4 nodes
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_2561e27d.bin (848505 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |
Command (COM trace) #1
UNKNWOWNmalicious
C:/Webhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5 malicious · 35 files
VBS25df8c46e6c294d62702eeb6d8a228d8T1027 · T1059 · T1059.005
Structure
VBSOverlay_2561e27d.bin
BATKNsmy0symRzwjjZVDkmmozpp.bat
EXEreviewCrt.exe
Structure
BINResources
BIN.Net Resources
VBSjSaqJlIaXrpMVGLICLmiWYm.vbe
BINResources
VBS25df8c46e6c294d62702eeb6d8a228d8.decoded.vbsT1027 · T1059 · T1059.005
VBS25df8c46e6c294d62702eeb6d8a228d8.decoded.vbs.deobfuscated.vbsT1059.005
No malware configuration was found at this point.
Command (COM trace) #1
UNKNWOWNmalicious
C:/Webhuhuhuhuhuhuhuhuhuhuhu
25df8c46e6c294d62702eeb6d8a228d8 › 25df8c46e6c294d62702eeb6d8a228d8.decoded.vbs
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
25df8c46e6c294d62702eeb6d8a228d8 › 25df8c46e6c294d62702eeb6d8a228d8.decoded.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.