Malicious
Malicious

4d9e7a5e24681bbcc2efa3e97c1e66e6

VBScript
MD5: 4d9e7a5e24681bbcc2efa3e97c1e66e6
Size: 38.62 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 4d9e7a5e24681bbcc2efa3e97c1e66e6
Sha1 5b977a9783682e41d67c84f3e524ca61749dfaa5
Sha256 34647bbf33ca3f21aa3dcd604e62dce27198bb6b451e9a00a1d72fe23400da1c
Sha384 208a671ddd3e9df644ee75ba9620d698092910734b8ed831fd073764bc97c8dfb9c506da673c521ff3efe2faf5b0d8a6
Sha512 f02b23425af312c17a1547aeec7c825709434789705667cefbee32461aaa3bc31351d01523a7cd067ef4feaa9ad4161757d2c03d9dd89d7e6fc610524fa97273
SSDeep 384:kBmvQRjXzhzeWvCubmrMx0rsJdEACqC3Cf8L7B/3:imoVDVRirMx0r8dEJ1Sf8J/3
TLSH 5F03C67D8954ACD2726336999C2AC1102C8CAA5BB4535C7439BF38C94B7634EBA3F1CC
4d9e7a5e24681bbcc2efa3e97c1e66e6
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Base64-Block@0x000074A6]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs>scr:ps1~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:ps1>scr:ps1
malicious 3 nodes
Path scr:vbs>enc:b64
Shape scr:vbs>enc:b64
2 nodes
4d9e7a5e24681bbcc2efa3e97c1e66e6
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Base64-Block@0x000074A6]
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙