Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 5f8ededeb1504b5f56c39c0ea2786eea
Sha1 9d5ab63fd0ead30104b985cab02b1ffee8c68a09
Sha256 2f9b061c52d00c94c62044d16a64e50410743ff33edbcf3e367bd6f58dbaa559
Sha384 a7e3263609efd04fcc51878e6b63f9f2796efb9a8238fede6f4a75f498ad097e1d7625c16cb093a8006fe64d442eb764
Sha512 12b827d18e852cd71934cf1ff066f6007b7f992f2db1f7b024b2e071336e889d89309dff19dbebdaec172d183a162c70a27982aae1e491fe2f4f5dd87b605442
SSDeep 12288:sDI9rLeD1yDVUjTHqPIn2l9ZD47WiJTDga42Ju2s:+9/n2l9ZD47pJTXU
TLSH E8B4F040EF5708FD81D4506502F68B3936754FFB03E1FA843A7EE886E35B99D229A4C6
5f8ededeb1504b5f56c39c0ea2786eea
Malicious
5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105
Shape scr:vbs>scr:ps1
malicious 2 nodes
Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1047~T1059.001~T1059.005
Shape scr:vbs>scr:ps1
malicious 2 nodes
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5f8ededeb1504b5f56c39c0ea2786eea
Malicious
5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
No malware configuration was found at this point.
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [PowerShell Command]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command]
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS] › [Deobfuscated PS]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
5f8ededeb1504b5f56c39c0ea2786eea › 5f8ededeb1504b5f56c39c0ea2786eea.deobfuscated.vbs › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙