Malicious
5873a091904bba25ec8af467d9d8edfe
VBScript
MD5: 5873a091904bba25ec8af467d9d8edfe
Size: 1.58 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 1.5 MB VBScript classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- fe4a930a99df7e32db43fd5545ff08a1ff89bce1343bf0ef2af3fcb1b7006907
- MD5
- 5873a091904bba25ec8af467d9d8edfe
- Verdict
- Malicious
- File type
- VBScript · 1.5 MB
- MITRE ATT&CK
- T1059.005
Cite this report: https://app.malva.re/sha256/fe4a930a99df7e32db43fd5545ff08a1ff89bce1343bf0ef2af3fcb1b7006907
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
1.58 MB · 1,579,750 B
First seen
2026-06-24 08:31 · 4 months ago
Last seen
2026-06-24 08:31 · 4 months ago
Last analysis
2026-06-28 13:52 · 4 months ago
Hashes
MD5
5873a091904bba25ec8af467d9d8edfe
Sha1
b7af939b494e66fbbd8eca01ab25fd105b650254
Sha256
fe4a930a99df7e32db43fd5545ff08a1ff89bce1343bf0ef2af3fcb1b7006907
Sha384
be1133c46e43ef3ffeaf2b5c4389a2d51bb2963385557876cb347150faf7d092fae772a10bc16ca67191b8910514b76b
Sha512
b1a37fb43d29f92bcd24cff6e83f547fb68694db6b7d9507921863b04af6f551be649f5d26433ea769bee231f1ad4ffa8abe42ed4bca31d048748b15970e82e7
SSDeep
768:OcCGCviADeVGmLHS9WUYiH+alKMoBp4YoXzc6tXzBfheaBMBl:Ob48WUBjDBNq7
TLSH
EF75C59816DACA0BE40310C53EA7697F9CF582B1025F4D42435FF27286AFB0E979719E
7 malicious · 7 files
VBS5873a091904bba25ec8af467d9d8edfeT1059.005
PS1[PowerShell Command]T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN5873a091904bba25ec8af467d9d8edfe.deobfuscated.vbs
SH[Command #0]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential7 malicious · 7 files
VBS5873a091904bba25ec8af467d9d8edfeT1059.005
PS1[PowerShell Command]T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN5873a091904bba25ec8af467d9d8edfe.deobfuscated.vbs
SH[Command #0]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
5873a091904bba25ec8af467d9d8edfe › 5873a091904bba25ec8af467d9d8edfe.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account