Malicious
VBScript
MD5: 3720d7f15181bfff196de27a81f080d0
Size: 61.44 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
61.44 KB · 61,440 B
First seen
2026-07-19 09:00 · 3 months ago
Last seen
2026-07-19 09:00 · 3 months ago
Last analysis
2026-07-19 09:00 · 3 months ago
Hashes
MD5
3720d7f15181bfff196de27a81f080d0
Sha1
dd402a3ff43f69bddfaaa3bb1fb26cbeb5b0b353
Sha256
1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292
Sha384
4b0e1301b416dd95b0fa90c135333421d1d0b52b8bcf97cd5a2f4b792c39e24f1e554269cb022fae4d1b5dc820f78241
Sha512
703b93f24e47e7f454d099a366f30f0a476414b0b804e14cdc64da43cffde49746ffa19e977d6a97025f57d60683f982559752fb5d2f8db3632c2bc4946fd85d
SSDeep
768:8P1hnNGAkeWMDCOGM3jShfS0huDfObgdvXpJtXwGlGbp3Q8W2VWr2hfS0h:2/NGxoDRx3280hubOoXPl8pAb280h
TLSH
BC534F3AD630FC91C75D327086661D9A21A86D56D7B30E64DB093DFE3D32780EF26688
12 malicious · 31 files
VBS3720d7f15181bfff196de27a81f080d0T1027 · T1059.001 · T1059.005
BINRoot Entry
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
VBS䡀㼿䕷䑬㭪䗤䠤T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Base64-Block]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
VBS3720d7f15181bfff196de27a81f080d0.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc~T1027~T1059.005>scr:vbs>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:vbs>scr:ps1
malicious
3 nodes
Path
ole:doc~T1027~T1059.005>bin
Shape
ole:doc>bin
technique2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
-once huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential