Malicious
VBScript
MD5: 664a9f319efc579071cd598fdeeb2d17
Size: 728.73 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 711.6 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- ee997b25bd0b45f0b348d60558c95a43c771488c250591d8164a86125a38d48b
- MD5
- 664a9f319efc579071cd598fdeeb2d17
- Verdict
- Malicious
- File type
- VBScript · 711.6 KB
Cite this report: https://app.malva.re/sha256/ee997b25bd0b45f0b348d60558c95a43c771488c250591d8164a86125a38d48b
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
728.73 KB · 728,729 B
Hashes
MD5
664a9f319efc579071cd598fdeeb2d17
Sha1
74f149feaf685c3692cc28e988ce886f46a37408
Sha256
ee997b25bd0b45f0b348d60558c95a43c771488c250591d8164a86125a38d48b
Sha384
c7dad18b3635766517fb80a1ac2f77f1a2829289f1b5cce98b0354f3ca1c72d208b2b7b35bb32b76b502d948f61a8c5b
Sha512
d875c6de7ba5f81e4b76155fa37518486c507332de1e72af4fea033adf8a3c481782e4e2c22d5062d284d08c43e1aab517340e21ff8d54ec0c966067979ab3a3
SSDeep
12288:jmffzBdxlV7J+MgXc+4dI9J2hTB12FGZhQzEkX+0vVmXz4qDU7klltL03h:qLHxlV75gXc/dSS9WGDvkXnVzMlK
TLSH
E8F423F068C8584049FD8F69E9C76990FB77207A26460D4EAC9AC35C1FF3AD7720EA51
Detection
Symbol obfuscation
Low
3 malicious · 3 files
VBS664a9f319efc579071cd598fdeeb2d17T1027 · T1059.005
VBS664a9f319efc579071cd598fdeeb2d17.deobfuscated.vbsT1059.005
BIN.executed
VBS.subscript.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.005
Shape
scr:vbs
malicious
1 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential