Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 164.8 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 4 embedded or derived files and a malware configuration (URLs (trace COM), URLs in PowerShell). It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1047, T1059.001, T1059.005 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
2f9d3b63a0ca7587c7210dcc9d6339eef60430e2a383949e43b0eeac821ea629
MD5
6a5985b4682898a15533d1e995c4af41
Verdict
Malicious
File type
VBScript · 164.8 KB
MITRE ATT&CK
T1027T1047T1059.001T1059.005T1105

Cite this report: https://app.malva.re/sha256/2f9d3b63a0ca7587c7210dcc9d6339eef60430e2a383949e43b0eeac821ea629

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
168.75 KB · 168,746 B
First seen
2026-10-27 06:45 · 2 hours ago
Last seen
2026-10-27 06:45 · 2 hours ago
Last analysis
2026-10-27 06:50 · an hour ago
Hashes
MD5 6a5985b4682898a15533d1e995c4af41 Sha1 8080f25f29f751ee58a8ab235efa3e6f0cb83875 Sha256 2f9d3b63a0ca7587c7210dcc9d6339eef60430e2a383949e43b0eeac821ea629 Sha384 fb272bba707c1f63b66942d7fd1d0fde667a3c467166abab4f49d8748b80a2bbff6789e79af2aa614a112f44f586b263 Sha512 bdd9251bcb97325a646861d770cbf5645a473a26a3dd4c61edba6f4af1b0b8fa1cfe813c987331841370a0aff25d77a939c29bd198156666e04c767c5d1d4105 SSDeep 768:R+ygckw32TBweYbXhIfVaKy/ePNh4y+k/tddBGHZtHmbtGHNvBGzNqxB32y8KOYU:/kwU1NzOa28os TLSH 6EF35315350D2023F3F76E08A0EED7CF7243EE8196F9D5449489A248AB73AA575FA30D
Detection
Symbol obfuscation
High

5 malicious · 5 files
VBS6a5985b4682898a15533d1e995c4af41
VBS6a5985b4682898a15533d1e995c4af41.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105
Shape scr:vbs>scr:ps1
malicious 2 nodes

Config. Field Value
URL (COM trace) #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious
line 4huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

5 malicious · 5 files
VBS6a5985b4682898a15533d1e995c4af41
VBS6a5985b4682898a15533d1e995c4af41.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]

Config. Field Value
URL (COM trace) #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious
line 4huhuhuhuhuhuhuhuhuhuhu
6a5985b4682898a15533d1e995c4af41
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
6a5985b4682898a15533d1e995c4af41
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙