Malicious
5f8ededeb1504b5f56c39c0ea2786eea
VBScript
MD5: 5f8ededeb1504b5f56c39c0ea2786eea
Size: 497.36 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
497.36 KB · 497,356 B
First seen
2026-09-01 06:30 · one month ago
Last seen
2026-09-01 06:30 · one month ago
Last analysis
2026-09-03 18:17 · one month ago
Hashes
MD5
5f8ededeb1504b5f56c39c0ea2786eea
Sha1
9d5ab63fd0ead30104b985cab02b1ffee8c68a09
Sha256
2f9b061c52d00c94c62044d16a64e50410743ff33edbcf3e367bd6f58dbaa559
Sha384
a7e3263609efd04fcc51878e6b63f9f2796efb9a8238fede6f4a75f498ad097e1d7625c16cb093a8006fe64d442eb764
Sha512
12b827d18e852cd71934cf1ff066f6007b7f992f2db1f7b024b2e071336e889d89309dff19dbebdaec172d183a162c70a27982aae1e491fe2f4f5dd87b605442
SSDeep
12288:sDI9rLeD1yDVUjTHqPIn2l9ZD47WiJTDga42Ju2s:+9/n2l9ZD47pJTXU
TLSH
E8B4F040EF5708FD81D4506502F68B3936754FFB03E1FA843A7EE886E35B99D229A4C6
Detection
Symbol obfuscation
Medium
14 malicious · 15 files
VBS5f8ededeb1504b5f56c39c0ea2786eeaT1027 · T1047 · T1105
VBS5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbsT1027 · T1047 · T1105
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
BIN[Base64-Block]
PS1[PowerShell Command]T1027 · T1047 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1047~T1059.001~T1059.005
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential14 malicious · 15 files
VBS5f8ededeb1504b5f56c39c0ea2786eeaT1027 · T1047 · T1105
VBS5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbsT1027 · T1047 · T1105
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
BIN[Base64-Block]
PS1[PowerShell Command]T1027 · T1047 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account