Malicious
28e808b881f24d532a4005c8a2965a73
HTML
MD5: 28e808b881f24d532a4005c8a2965a73
Size: 29.54 KB
text/html
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
29.54 KB · 29,541 B
Hashes
MD5
28e808b881f24d532a4005c8a2965a73
Sha1
a64753890e81075163de242fe0cd63ede204ebe7
Sha256
8b78e7410ded464bbc641584f404cb697bbc2039a1349b4e3fa2d630948c2f18
Sha384
47823f9136bcd72354e7c6aca89a99aaee5701be716ee06fe3290bb1ff49a9b5a6494772f7fc62f9ae2357abd9b6a581
Sha512
2dddf29e6c237123ff999de69220b419f97109e3491d51a3b261920a1f0e8d4e75a8da8efb28a80260941668aa71b8217963c1753566b8b12fed68bd142a81ca
SSDeep
192:F7tXhc6l/cHINxMO1fHUsZowrxbsIK8/pOdH/tiXRvKOkwd8jnLwLy:hcDoNxMy0NAe0KLxLwLy
TLSH
C6D2C6839826C084C334FDCE56EE35CC67943AAA3CC3190D5CE75F4C2A665AFD643A5A
Detection
Symbol obfuscation
Low
7 malicious · 9 files
HTM28e808b881f24d532a4005c8a2965a73T1027 · T1059 · T1059.001
VBS28e808b881f24d532a4005c8a2965a73.deobfuscated.vbsT1059.005
SH[Command #0]
BIN[Base64-Block]
SH[Command #1] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
html~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
html>scr:bat>scr:ps1
malicious
3 nodes
Path
html~T1027~T1059~T1059.005>scr:vbs~T1059.005
Shape
html>scr:vbs
malicious
2 nodes
Command (COM trace) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential7 malicious · 9 files
HTM28e808b881f24d532a4005c8a2965a73T1027 · T1059 · T1059.001
VBS28e808b881f24d532a4005c8a2965a73.deobfuscated.vbsT1059.005
SH[Command #0]
SH[Command #1] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Command (COM trace) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
28e808b881f24d532a4005c8a2965a73
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
28e808b881f24d532a4005c8a2965a73
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account