Malicious
Malicious

4caa5bed30d1ca2f35fca0bdce15b927

VBScript
MD5: 4caa5bed30d1ca2f35fca0bdce15b927
Size: 664 B
text/vbscript
Ctrl + scroll to zoom · drag to pan

This sample is a 664 bytes VBScript classified as malicious by Malva.RE. Static analysis extracted 4 embedded or derived files and a malware configuration (URLs (trace COM), URLs in PowerShell). It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059, T1059.001, T1059.005 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0510c1062195585bc2aea36c3e9e25a67ee28b15bec6ba38969e26bb829cc494
MD5
4caa5bed30d1ca2f35fca0bdce15b927
Verdict
Malicious
File type
VBScript · 664 bytes
MITRE ATT&CK
T1027T1059T1059.001T1059.005T1105

Cite this report: https://app.malva.re/sha256/0510c1062195585bc2aea36c3e9e25a67ee28b15bec6ba38969e26bb829cc494

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
664 B · 664 B
Hashes
MD5 4caa5bed30d1ca2f35fca0bdce15b927 Sha1 7a3dcfe45cc21b9fae95d98110d810a037329684 Sha256 0510c1062195585bc2aea36c3e9e25a67ee28b15bec6ba38969e26bb829cc494 Sha384 5c2ac7f901d58b55f4639008cf754d0cc3383272e00f2da7e5f09a98f8cefbe500e4ad46d6ccfc8734d82ab8c4681fa4 Sha512 dfa6fe77ad41d99dff8ebd759003bb91d8fd87e16c3c9c0d3d64e529262b33cdcf75a0ec445d499ca00250adca3d58ce7f76e2311164c8a3658c063d75a813c6 SSDeep 12:Z522VF2G0GVlMqeUPgnzyZtZ4IEde8jLJb+0051WqDLDbE5TZXq3g4Nbx/Qb:m2VAkVSDwgzyZtZydLN+0LqPE5FXq3gn TLSH 5301025B7D264E25E8ED218855FC454CE8A7D79A8004B8E56F609C1BD40CB5993C86F2

5 malicious · 5 files
VBS4caa5bed30d1ca2f35fca0bdce15b927
VBS4caa5bed30d1ca2f35fca0bdce15b927.deobfuscated.vbs
SH[Command #0]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001~T1105
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes

Config. Field Value
URL (COM trace) #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
bitsadhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

5 malicious · 5 files
VBS4caa5bed30d1ca2f35fca0bdce15b927
VBS4caa5bed30d1ca2f35fca0bdce15b927.deobfuscated.vbs
SH[Command #0]
PS1[PowerShell Command]
PS1[Deobfuscated PS]

Config. Field Value
URL (COM trace) #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
4caa5bed30d1ca2f35fca0bdce15b927
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
4caa5bed30d1ca2f35fca0bdce15b927
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
4caa5bed30d1ca2f35fca0bdce15b927
Deobfuscated PowerShell UNKNWOWNmalicious
bitsadhuhuhuhuhuhuhuhuhuhuhu
4caa5bed30d1ca2f35fca0bdce15b927 › 4caa5bed30d1ca2f35fca0bdce15b927.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙