Malicious
VBScript
MD5: 2b5df498e97a35f47d3491905c04d3f7
Size: 339.59 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 331.6 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 5daa33f1bc524b04e655b08a562830ee20bfd507d9ec6058022170f7dfb8aa18
- MD5
- 2b5df498e97a35f47d3491905c04d3f7
- Verdict
- Malicious
- File type
- VBScript · 331.6 KB
Cite this report: https://app.malva.re/sha256/5daa33f1bc524b04e655b08a562830ee20bfd507d9ec6058022170f7dfb8aa18
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
339.59 KB · 339,585 B
First seen
2026-11-04 11:00 · an hour ago
Last seen
2026-11-04 11:00 · an hour ago
Last analysis
2026-11-04 11:01 · an hour ago
Hashes
MD5
2b5df498e97a35f47d3491905c04d3f7
Sha1
3920631d6d66041577888057831e3efdfdeafe7b
Sha256
5daa33f1bc524b04e655b08a562830ee20bfd507d9ec6058022170f7dfb8aa18
Sha384
350607aedb08004d2adce796938a657cfdd905988d419a3d78d1bf18144aa6de35160d14e6161c272e1c7ee9af496c3d
Sha512
4fba555632dd72a0be5503fffea1732a9e44b7ffbc265e15cca242cdb205cff8ea7fa0128fbad157c9fa495c8abe84ec3f5fd3dfc2d11dae3704bce6b5f51426
SSDeep
6144:pyKqEaryuT+Aclft4DZDRuViOa7K1bLT6Kzf/l27vrBmbrSwT3bkf8O6NLzPq0Y0:3JuT+Aclft4DZDRuQ7KV/z1MMrn/kUft
TLSH
7A7412A1528039A8F0BCDE37DC86AB13186901FAF74469F23ECD698A1657E155383FD3
Detection
Symbol obfuscation
Low
3 malicious · 3 files
VBS2b5df498e97a35f47d3491905c04d3f7T1027 · T1059.005
VBS2b5df498e97a35f47d3491905c04d3f7.deobfuscated.vbsT1059.005
BIN.executed
VBS.subscript.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.005
Shape
scr:vbs
malicious
1 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential