Malicious
36eaf19718e61208b6c13e2cdd693566
VBScript
MD5: 36eaf19718e61208b6c13e2cdd693566
Size: 53.08 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
53.08 KB · 53,079 B
First seen
2026-07-11 07:17 · 3 months ago
Last seen
2026-07-11 07:17 · 3 months ago
Last analysis
2026-07-12 23:55 · 3 months ago
Hashes
MD5
36eaf19718e61208b6c13e2cdd693566
Sha1
bede0517bda4b956f062869a5c130cfff7f24b42
Sha256
ae5e5ae12ed257ab82efc258dce8da1daaa662159553b8107de78271113300c7
Sha384
a6a1b517f8ea1ab3b7c48fd7bb9f66d957356b2d9e61c6c16a4c09591b520ba78fa81da9d5998a3b7a444998bfb72955
Sha512
44b7219ee3121baf576ed38bdf2f5a306f4013a19d2fba803f9be34d4df536ad1fc80af49ea0c0f5c3705fc19c62d53bd86902346bb5768dfccefce57c56cd72
SSDeep
96:FzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzkAM+7y6YdTnYXJSTYa1:ujrJeGVBUex1o0wQzn1E20+H
TLSH
F033D30FCCDC357E7A9E888875A5446C21368E8CF42A5C46D8D4A6487F82AF4DEC5E3D
19 malicious · 20 files
VBS36eaf19718e61208b6c13e2cdd693566T1027 · T1059.001 · T1059.005
VBS36eaf19718e61208b6c13e2cdd693566.deobfuscated.vbsT1027 · T1059.001 · T1059.005
SH[Command #0] T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
5 / 5
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:ps1>scr:ps1
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential19 malicious · 20 files
VBS36eaf19718e61208b6c13e2cdd693566T1027 · T1059.001 · T1059.005
VBS36eaf19718e61208b6c13e2cdd693566.deobfuscated.vbsT1027 · T1059.001 · T1059.005
SH[Command #0] T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
BIN[Base64-Block]
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
36eaf19718e61208b6c13e2cdd693566 › 36eaf19718e61208b6c13e2cdd693566.deobfuscated.vbs › [Command #0]
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
36eaf19718e61208b6c13e2cdd693566 › 36eaf19718e61208b6c13e2cdd693566.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account