Malicious
Malicious

26a61f2e7f8195aeeb0525dd964a98cf

VBScript
|
MD5: 26a61f2e7f8195aeeb0525dd964a98cf
|
Size: 9.33 KB
|
text/vbscript

Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
26a61f2e7f8195aeeb0525dd964a98cf
Sha1
18bc18275fc047f9674704c19d2980470e3272ee
Sha256
c520b4e69be0b921bc01662062d0dd82e4165f91069ed81c49a9b84031e43784
Sha384
bffa5668f160818339b0b5b2e2d6fc7f8c890ca506ea38b5b5ca363bb060234fb62e1df4f627b96dd65fb85a19e98736
Sha512
01f747ce17922ba1bad7408015703e54b0e580b5fb1a4e72c7448e272f078ca2a67270594ef27f6a6b2213b96959458e05a6ddbfd55c87dd467096d01dc62003
SSDeep
96:xJK0jSzwPFlzPP1YXr+TPziU7WJMzD7lVu6KbHKXPLSc8ZYP/twUptv:xSwdlzPP1YXr+Tm0lVIE1rb
TLSH
83122F52CD810CDE07A940BF6E65EA4CB47683BFC82D3E60705DCA76DF666CC42A14B2
File Structure
26a61f2e7f8195aeeb0525dd964a98cf
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
Artefacts
Name
 Value
Deobfuscated PowerShell

-verb "RunAs" -Wait -ArgumentList "-ExecutionPolicy Bypass -File """ & scriptPath & """" " envObj.Run " "powershell" -Command " & MnLine, 1, True envObj.Run " "ping" "127.0.0.1" -n 3 "completed window.close </script> </head> <body> <h3>verification complete</h3> </body> </html>"
26a61f2e7f8195aeeb0525dd964a98cf (9.33 KB)
File Structure
26a61f2e7f8195aeeb0525dd964a98cf
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
Deobfuscated PowerShell

-verb "RunAs" -Wait -ArgumentList "-ExecutionPolicy Bypass -File """ & scriptPath & """" " envObj.Run " "powershell" -Command " & MnLine, 1, True envObj.Run " "ping" "127.0.0.1" -n 3 "completed window.close </script> </head> <body> <h3>verification complete</h3> </body> </html>"

Malicious

26a61f2e7f8195aeeb0525dd964a98cf > [PowerShell Command] > [PowerShell Command]
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙