Malicious
450cf39e41e6a5073255ad52311fa404
VBScript
MD5: 450cf39e41e6a5073255ad52311fa404
Size: 64.46 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
64.46 KB · 64,455 B
First seen
2026-08-24 19:15 · 2 months ago
Last seen
2026-08-24 19:15 · 2 months ago
Last analysis
2026-09-03 18:07 · one month ago
Hashes
MD5
450cf39e41e6a5073255ad52311fa404
Sha1
35da7e4697286dcf6ad1bb2dbb96bbf449129bfb
Sha256
d28dc0f5aed61adab3547ea9ffba04b4280460a80ed1181b27de4836c4ca655a
Sha384
2b8bdb79ffe67e85885fa47faec2847e01869a93e4cdc51cefa8e04a25e51a94235ae8cef1061ea03ffad3e0ae6c2e9e
Sha512
ff3acfab6c8264982b94cf0442745855abe701c59cdc1d0bff5b24222c1584e9c6cf51448115e9922db4caeca709461fc8b330567fd6ea8c105bf1e0876da3b3
SSDeep
768:NF0vBjjL4Z2zYUR9/4X2MJx/ptFzvBa6gZkabcSxgObucgSKTonmYN3Jw6bYcZEV:ojM9Kms8gTOP
TLSH
27538FA21F28C0E32D5DB05860C1DFEE86767127B9B94D0717649BA2CEBD1CB3E855C2
Detection
Symbol obfuscation
Low
10 malicious · 10 files
VBS450cf39e41e6a5073255ad52311fa404T1027 · T1059 · T1105
VBS450cf39e41e6a5073255ad52311fa404.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential10 malicious · 10 files
VBS450cf39e41e6a5073255ad52311fa404T1027 · T1059 · T1105
VBS450cf39e41e6a5073255ad52311fa404.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
450cf39e41e6a5073255ad52311fa404
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
450cf39e41e6a5073255ad52311fa404 › 450cf39e41e6a5073255ad52311fa404 › .executed › .subscript.vbs
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
450cf39e41e6a5073255ad52311fa404 › 450cf39e41e6a5073255ad52311fa404 › .executed › .subscript.vbs › .subscript.vbs.deobfuscated.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
450cf39e41e6a5073255ad52311fa404 › 450cf39e41e6a5073255ad52311fa404 › .executed › .subscript.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
450cf39e41e6a5073255ad52311fa404 › 450cf39e41e6a5073255ad52311fa404 › .executed › .subscript.vbs › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account