Malicious
VBScript
MD5: 4cab813e2894bffb6198c7d60e86b425
Size: 30.21 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
30.21 KB · 30,208 B
First seen
2026-07-16 07:02 · 3 months ago
Last seen
2026-07-16 07:02 · 3 months ago
Last analysis
2026-07-16 21:45 · 3 months ago
Hashes
MD5
4cab813e2894bffb6198c7d60e86b425
Sha1
5478d96e676953d2e5acc7711fc82c52ae2ed2f1
Sha256
db9f371944f479149923ae63235942953a2b6388a4ab2c29d7bf7dd144c9a71c
Sha384
e226934ff506802633500dac861a8907a1404582d380f8c73f091293eaed5cd95322a800ffa772789a5ab42007a6b961
Sha512
2ba83944f17902ffc48b271e9da4684da819679f8f0b5970b6073929b2846256c0b1332730030658718547e180e65b6ba06eeadb3c30d9549c303bdd609ab9c0
SSDeep
192:wTeKa88ZEvA+6/6rNavrgYjk+4bWl/gkMZ3l1DxtkR8na50jnJAtts56Ka:wc2iSwvxjk+t/m1P2RAa50jn+ttf
TLSH
1CD29212B2C9CE1BF16251724ED7C6D6B229BE1D9E12C70B33547F1EBCB4AB08621752
3 malicious · 15 files
VBS4cab813e2894bffb6198c7d60e86b425T1027 · T1059.005
BINRoot Entry
BIN1Table
BINCompObj
BINWordDocument
BINSummaryInformation
BINDocumentSummaryInformation
BINMacros
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAThisDocument
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
VBS4cab813e2894bffb6198c7d60e86b425.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
ole:doc~T1027~T1059.005>bin
Shape
ole:doc>bin
technique2 nodes
Path
ole:doc~T1027~T1059.005>ole:vba
Shape
ole:doc>ole:vba
technique2 nodes
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential