Malicious
VBScript
MD5: 3a7e78b5f76143d72824e01db6940e3c
Size: 944.41 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
944.41 KB · 944,405 B
First seen
2026-08-06 14:31 · 2 months ago
Last seen
2026-08-06 14:31 · 2 months ago
Last analysis
2026-08-06 19:55 · 2 months ago
Hashes
MD5
3a7e78b5f76143d72824e01db6940e3c
Sha1
d139f398b0378dcedf8f57490aa7eb4dc31d9810
Sha256
ecf36a1837197b217b8efbf43a20b30145ab60eefc3cd4577bae9057aa46f4c7
Sha384
fc0c78ebdd454cf7df00d7c18e17d923c2483d070a29835eff36957e47965fae85d086e6d3e02286e9c1e1c869e081f5
Sha512
bab976e14534c7554d88a8d44580f7f848603bb0e2dd1c0ef425551e8ae673e56c2fb465b9f117da4ad2de0a3fa704a8d6e41a45010752c217a5897a145f7126
SSDeep
768:T8gt0wOb54mxYSYYPG1E27zpiXIUd6lZinMEwzggnIJzmEgvjn7S/FKhufMn28Jw:s
TLSH
59154957E4EDA93D638A12762D32F3D3B6BD304154045AB7639EEC203877A03647AEB1
7 malicious · 8 files
VBS3a7e78b5f76143d72824e01db6940e3cT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN3a7e78b5f76143d72824e01db6940e3c.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1059.005>scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1059.005
Shape
scr:vbs>scr:ps1>scr:vbs
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential