Malicious
674644c5e8e89fbd13b1e85631222b92
VBScript
MD5: 674644c5e8e89fbd13b1e85631222b92
Size: 3.43 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score
Medium
| MD5 | 674644c5e8e89fbd13b1e85631222b92 |
| Sha1 | 71bdc656e3b615abb31a5084170aeb7891e1ec6d |
| Sha256 | 72f1a91566f9a644b5795e23caa003780a4869fa903607fbe705382c19c545af |
| Sha384 | a65c34f6ff3b5ec1c278c82c40cd20be5e5837eeae63a331c8bfe8ae8ed63545574019a0e26de1f760376402cf90d045 |
| Sha512 | 50550b11e6b11004682cd046ea4e012b183297e29dd52d0c2ffb74d17f9d6a786bc4e66e184f88d7c5c436c3cec935085a28c2e1c4d14c0df8d8aa8e1bf8a0f2 |
| SSDeep | 96:NGaSGf5r2cZlfwG8EstCg1/TAnIf2N/X6TG0iW:0aZtHfaPCCeIf2mG0T |
| TLSH | 2C61510F7C4B41A2DC79C1078B1A3A5FCAC3166B161000B9FABC94492F3166FC6F91A7 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1059.001~T1105
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
wschuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
wschuhuhuhu
674644c5e8e89fbd13b1e85631222b92
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
674644c5e8e89fbd13b1e85631222b92
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
674644c5e8e89fbd13b1e85631222b92
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.