Malicious
5077c7b3bca4be2a24a3df85ee8dafe1
VBScript
MD5: 5077c7b3bca4be2a24a3df85ee8dafe1
Size: 2.6 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 2.5 MB VBScript classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- aa1ce6d1e8a996289dc3ee9f7fa906319bfc9acf7ebf550870d07be40a118898
- MD5
- 5077c7b3bca4be2a24a3df85ee8dafe1
- Verdict
- Malicious
- File type
- VBScript · 2.5 MB
- MITRE ATT&CK
- T1059.005
Cite this report: https://app.malva.re/sha256/aa1ce6d1e8a996289dc3ee9f7fa906319bfc9acf7ebf550870d07be40a118898
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
2.6 MB · 2,596,078 B
First seen
2026-06-30 11:01 · 4 months ago
Last seen
2026-06-30 11:01 · 4 months ago
Last analysis
2026-07-02 17:29 · 4 months ago
Hashes
MD5
5077c7b3bca4be2a24a3df85ee8dafe1
Sha1
bee1ef356ed8db8049836809e921d5b7db5cc052
Sha256
aa1ce6d1e8a996289dc3ee9f7fa906319bfc9acf7ebf550870d07be40a118898
Sha384
d55dac57c18d594b2105a53032975dcaa1857ed7bd8b57e7b964590315696097d9b9e903dfbbbf882356ae210105995c
Sha512
13487b19077207feef7e8d43e6e2006669e694e349b241c3e1e8077d5c4dca225aec1d2240dff3febf63fc44b06864171ba3c36993eb4176b98a5423d6f7d503
SSDeep
192:S33333333333333333333333333333333333333333333333333333333333333V:mRzUA
TLSH
D1C56DE191681D38E6397B540A69326B3CBD760DCE0E10D9A82E47720EE7781CFF574A
7 malicious · 7 files
VBS5077c7b3bca4be2a24a3df85ee8dafe1T1059.005
PS1[PowerShell Command]T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN5077c7b3bca4be2a24a3df85ee8dafe1.deobfuscated.vbs
SH[Command #0]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential7 malicious · 7 files
VBS5077c7b3bca4be2a24a3df85ee8dafe1T1059.005
PS1[PowerShell Command]T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN5077c7b3bca4be2a24a3df85ee8dafe1.deobfuscated.vbs
SH[Command #0]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
5077c7b3bca4be2a24a3df85ee8dafe1 › 5077c7b3bca4be2a24a3df85ee8dafe1.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account