Malicious
VBScript
MD5: 3b7b867b3a65da1c9d8228f1b16593bc
Size: 31.28 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 30.5 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- b8255e36c40d7f2cf6602ee57afa0518bebce895d69987bb50a073657e2605e0
- MD5
- 3b7b867b3a65da1c9d8228f1b16593bc
- Verdict
- Malicious
- File type
- VBScript · 30.5 KB
Cite this report: https://app.malva.re/sha256/b8255e36c40d7f2cf6602ee57afa0518bebce895d69987bb50a073657e2605e0
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
31.28 KB · 31,281 B
Hashes
MD5
3b7b867b3a65da1c9d8228f1b16593bc
Sha1
43eccb533d4fbcfbec1fa2ef5610decb1b913ca5
Sha256
b8255e36c40d7f2cf6602ee57afa0518bebce895d69987bb50a073657e2605e0
Sha384
2ff9dc9ce9b4cba69b867cd2e954ff798eca174d88f51195db0819bee831acf7b8712b310dc08c5c235209c891cc5d20
Sha512
eedda0f2f32507b4328f32aa4ce6d6773390703f44560f2370dce576d63f7d026c9eff5a83306a2b12b07da3b2369b48ea7e4189dd085e5dc97d72eeca4aecf9
SSDeep
768:HYrcWAgVGmx4QMumddf6mEQj/WK0tCLZlPM7:3Wzx4RsmBqKimPPM7
TLSH
46E24B12FE45614C8E476BF7DCAB4171CABC476A00631630EFE9F21D6806668B73CD2A
Detection
Symbol obfuscation
Low
2 malicious · 2 files
VBS3b7b867b3a65da1c9d8228f1b16593bcT1027 · T1059.005
VBS3b7b867b3a65da1c9d8228f1b16593bc.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.005
Shape
scr:vbs
malicious
1 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential