Malicious
4f627a972c41186163440e9ddd5f743d
VBScript
MD5: 4f627a972c41186163440e9ddd5f743d
Size: 69.29 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 67.7 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 8 embedded or derived files. It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 8e1e6dc8ef06f45542d56c36c6bff2d9bd1f0b29e342c4e5f8137bdd796989de
- MD5
- 4f627a972c41186163440e9ddd5f743d
- Verdict
- Malicious
- File type
- VBScript · 67.7 KB
Cite this report: https://app.malva.re/sha256/8e1e6dc8ef06f45542d56c36c6bff2d9bd1f0b29e342c4e5f8137bdd796989de
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
69.29 KB · 69,289 B
First seen
2026-11-02 13:45 · 6 hours ago
Last seen
2026-11-02 13:45 · 6 hours ago
Last analysis
2026-11-02 13:46 · 6 hours ago
Hashes
MD5
4f627a972c41186163440e9ddd5f743d
Sha1
0462189914725bb14ae691ab2f6d61637e2a8d2f
Sha256
8e1e6dc8ef06f45542d56c36c6bff2d9bd1f0b29e342c4e5f8137bdd796989de
Sha384
321f9d3f914f5cc3dacb7fd07e510a25f4d72f95852ea8518999341a500c5c3e6c7dce80cf0dbf138ed34a194a3f6c36
Sha512
59cade1fa37090b1806b7a4ff892942d1f6ce83a4a934fb5a226ecfcdada28b5e4e3fa8d1a30720237eef294ee7a4837c167a0866ffdeaf7ab974047a8e89af7
SSDeep
768:cs6x4zKFaJhYWQG2BfSWNQEg4hNzE2X8rdhxeEmeG2yUouhgsN+FX:cs60K8JJefLOv4h6jx97eu+M+t
TLSH
37639FAEDA1101210BC73AD7DE454D20A37771CF3F2260647A9BE34964C777EE7AA206
Detection
Symbol obfuscation
Medium
5 malicious · 6 files
VBS4f627a972c41186163440e9ddd5f743dT1027 · T1059.001 · T1059.005
VBS4f627a972c41186163440e9ddd5f743d.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential5 malicious · 6 files
VBS4f627a972c41186163440e9ddd5f743dT1027 · T1059.001 · T1059.005
VBS4f627a972c41186163440e9ddd5f743d.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
4f627a972c41186163440e9ddd5f743d
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account