5ce084dd5c13865e26f2940083c36f7a

VBScript

MD5: 5ce084dd5c13865e26f2940083c36f7a

Size: 619.7 KB

text/vbscript

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

VBScript file

Size

619.7 KB · 619,701 B

First seen

2026-08-27 08:30 · 2 months ago

Last seen

2026-08-27 08:30 · 2 months ago

Last analysis

2026-09-03 18:11 · one month ago

Hashes

MD5 5ce084dd5c13865e26f2940083c36f7a Sha1 39d8b730692baaa2f085dc81ba87058d13f9d9f3 Sha256 f3c59bba59773c07124f6a69ec0ed4a1a48508cec341ab24f92a7264507a6d15 Sha384 8f272f55f5df29bbf7ae88194b5dcb8ba8fcfb3778c0e5b86bc2078e9d0a819e60ed2b21c50a9d9f27e4a3011c2367f7 Sha512 8859520d21c3dae26e72e2c97e87ba243d2774a80241f4d0e4dc25a98d9d5b8bb83b1811669d5b103639f42fb8597b4962c13def6293839c106345eb006b5bb7 SSDeep 1536:1QayV3X7a6a86j9RUt5Z8lQcVEBRhFJ4BqGFRm5:jY TLSH 03D4630861869A6D5670828FC4B672CBEF5C25DB3690C3BE0C7974EA3653D2DDB938C1

Detection

Symbol obfuscation

Very low

21 malicious · 22 files

VBS5ce084dd5c13865e26f2940083c36f7a

VBS5ce084dd5c13865e26f2940083c36f7a.deobfuscated.vbs

SH[Command #0]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:bat~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105

Shape scr:vbs>scr:bat>scr:ps1

malicious 3 nodes

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105

Shape scr:vbs>scr:ps1

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

21 malicious · 22 files

VBS5ce084dd5c13865e26f2940083c36f7a

VBS5ce084dd5c13865e26f2940083c36f7a.deobfuscated.vbs

SH[Command #0]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

5ce084dd5c13865e26f2940083c36f7a

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

5ce084dd5c13865e26f2940083c36f7a › 5ce084dd5c13865e26f2940083c36f7a.deobfuscated.vbs › [Command #0]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential