Sign up free
Suspicious
Suspect

263347f6a949cd9937ce0aba04e024ba

Share on LinkedIn
Print
VBScript
MD5: 263347f6a949cd9937ce0aba04e024ba
Size: 6.91 MB
text/vbscript

This sample is a 6.6 MB VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 13 embedded or derived files. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
5bbefa192f703bf2058da8cc43f6823d43b099ab76b322ac31848178db00144b
MD5
263347f6a949cd9937ce0aba04e024ba
Verdict
Inconclusive
File type
VBScript · 6.6 MB

Cite this report: https://app.malva.re/sha256/5bbefa192f703bf2058da8cc43f6823d43b099ab76b322ac31848178db00144b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
6.91 MB · 6,913,792 B
First seen
2026-10-01 20:45 · one month ago
Last seen
2026-10-01 20:45 · one month ago
Last analysis
2026-10-01 20:45 · one month ago
Hashes
MD5 263347f6a949cd9937ce0aba04e024ba Sha1 bbb59c964c716d5a14c25cda1655657ef56cdcf4 Sha256 5bbefa192f703bf2058da8cc43f6823d43b099ab76b322ac31848178db00144b Sha384 142c79aade81a67cca083933eb604392aab70f3f0126e5e2ec08181fbe58a523185dfab637c2a76dcca1d1affb97737f Sha512 5ecd128e3a7b61dd05b2ef502e709bcfeb46cd6af8684c88a770a36dd67e02ab73d9b4807dda5eaf1807eedc3d78c50024142b4f139f32bbdf5484515f1a41be SSDeep 196608:fME3ZDVn/XIRut/6dBCGcPH/IMG3MhuT78eLCaWkwZ:DP/XAc6H1cPH/G3h785N TLSH 8366337BD995AC74D3D21EB1DCDB4E0B2232EC3B2751982272EC69065CC16A343771AE
Detection
PeID
Borland Delphi 4.0Inno Installer v4.0.5] ;collides with: Inno Setup Module Heuristic Mode (Inno SFX)Inno Setup ModuleInno Setup Module Heuristic ModeMicrosoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

14 files
VBS263347f6a949cd9937ce0aba04e024ba
Structure
VBSOverlay_5ca81588.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>scr:vbs
Shape pe:exe>scr:vbs
2 nodes

Name Value
Info
Overlay extracted: Overlay_5ca81588.bin (6845696 bytes)

An error has occurred. This application may no longer respond until reloaded. Reload 🗙