Malicious
Malicious

4cf006d99caeee3c18c2afe5fc8d9ab1

Share on LinkedIn
Print
VBScript
MD5: 4cf006d99caeee3c18c2afe5fc8d9ab1
Size: 17.49 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan

This sample is a 17.1 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 54 embedded or derived files and a malware configuration (URLs (trace COM), URLs in PowerShell, DownloadFile@0x0327, DownloadFile@0x00D3). It matches 86 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059, T1059.001, T1059.005 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
42c93f8cf092fd4e4877189e83fd8f693822310498d45ab163d3bce03c8ea831
MD5
4cf006d99caeee3c18c2afe5fc8d9ab1
Verdict
Malicious
File type
VBScript · 17.1 KB
MITRE ATT&CK
T1027T1059T1059.001T1059.005T1105

Cite this report: https://app.malva.re/sha256/42c93f8cf092fd4e4877189e83fd8f693822310498d45ab163d3bce03c8ea831

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
17.49 KB · 17,494 B
First seen
2026-10-28 11:00 · 14 hours ago
Last seen
2026-10-28 11:00 · 14 hours ago
Last analysis
2026-10-28 11:01 · 14 hours ago
Hashes
MD5 4cf006d99caeee3c18c2afe5fc8d9ab1 Sha1 7e7189e702406d89901592ddc6466e9cc5e351de Sha256 42c93f8cf092fd4e4877189e83fd8f693822310498d45ab163d3bce03c8ea831 Sha384 7edd318a0624450992f11bf91ef3f898e81d5b62bc7bcc1d2c4a80ef81b6bc544f5b15679e61f9975e01cc57b38f26e5 Sha512 8157dbd1c32049fc9e289dd3b489a95de300995c1efc05cf0fcef73fb0f06f7fe27cde0a3172f39820db07d0847660302b4b1035d95c073e1d91779b445c6eba SSDeep 96:EePuRPotmwkyjvN3cIzEO0I9N+tkbMZ/kO0I9HWtjm6qD/NO0I9bP/iO0I9N+HbT:HUwk4wEeY2Fm/grC7X4wJ3kb1X TLSH 6F72BE2155BCB24896CCD024A358E7175D85208FD76830DBEA7BFCBC60BA0E495DB5C7
Detection
Symbol obfuscation
Low

55 malicious · 55 files
VBS4cf006d99caeee3c18c2afe5fc8d9ab1
VBS4cf006d99caeee3c18c2afe5fc8d9ab1.deobfuscated.vbs
SH[Command #0]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
SH[Command #1]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
SH[Command #2]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
SH[Command #3]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
SH[Command #4]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
BIN4cf006d99caeee3c18c2afe5fc8d9ab1.comtrace
SH[Command #5]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
SH[Command #6]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path scr:vbs~T1027~T1059~T1059.001~T1059.005~T1105>scr:bat>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes
Path scr:vbs~T1027~T1059~T1059.001~T1059.005~T1105>scr:bat~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes

Config. Field Value
URL (COM trace) #1 https:huhuhuhuhuhuhuhuhuhuhu
URL (COM trace) #2 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
Payload URI huhuhuhu
Payload Destination huhuhuhu
Payload Destination c:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
Payload URI huhuhuhu
Payload Destination huhuhuhu
Payload Destination c:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #2 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #3 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #4 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #5 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhu
Command (COM trace) #6 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #7 UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #8 UNKNWOWNmalicious
"C:\Prhuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1 PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
taskkihuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
net "huhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
[Servihuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
wmic huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
wmic huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
wmic huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
wmic huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙