Ctrl + scroll to zoom · drag to pan
The file 3eb7a2e4f58e7e985e2e1b4eb41c885d is a VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 20 embedded or derived files. It matches 29 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- —
- MD5
- -
- Verdict
- Malicious
- File type
- VBScript
- MITRE ATT&CK
- T1059.005
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
21 malicious · 21 files
VBS3eb7a2e4f58e7e985e2e1b4eb41c885dT1059.005
PS1[PowerShell Command]T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
SH[Command #0]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.005
PS1[PowerShell Command]T1059.005
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN3eb7a2e4f58e7e985e2e1b4eb41c885d.deobfuscated.vbs
SH[Command #0]
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"Scriphuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
scripthuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
scripthuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential