6ad998bd6bccefde05e871bcb73d6488

VBScript

MD5: 6ad998bd6bccefde05e871bcb73d6488

Size: 82.34 KB

text/vbscript

Ctrl + scroll to zoom · drag to pan

This sample is a 80.4 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files and a malware configuration (URLs (trace COM), URLs in PowerShell). It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1047, T1059.001, T1059.005 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: 9f43fb1283711adb7e64248d66c3367d70ccfb8d5a771b0c6be426f7f49bcc63
MD5: 6ad998bd6bccefde05e871bcb73d6488
Verdict: Malicious
File type: VBScript · 80.4 KB
MITRE ATT&CK: T1027 T1047 T1059.001 T1059.005 T1105

Cite this report: https://app.malva.re/sha256/9f43fb1283711adb7e64248d66c3367d70ccfb8d5a771b0c6be426f7f49bcc63

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

VBScript file

Size

82.34 KB · 82,338 B

First seen

2026-11-04 11:00 · an hour ago

Last seen

2026-11-04 11:00 · an hour ago

Last analysis

2026-11-04 11:01 · an hour ago

Hashes

MD5 6ad998bd6bccefde05e871bcb73d6488 Sha1 8a9b11ab29e48c4706c7218dad48f37bce15ca8f Sha256 9f43fb1283711adb7e64248d66c3367d70ccfb8d5a771b0c6be426f7f49bcc63 Sha384 cfa218209b86aac49017f1a03d7cd5e958de08e3a2a9ac8f1b7ba606999c55a553dbc27480694de45332b3d0f33990c6 Sha512 8b81b2de900e1d87e56e876e5f4db91bb2340e0b36f222a5ed12556311b5a9a64c8dc8c3c0fa4e204980ba2b517ec898c689fb2b36bc2bb922beff3d318a3ece SSDeep 192:vDVWhHIXDJSof0wF5uKFmEYf2kO0O40OS1JOs6Ymn7e2pZjwwA8pUZz6kJCFJmbR:vKv8Zvo2D1f6deNBJ6eWYoK+uMy17 TLSH CB83BC5FAAF465C4D0FA1F80A4389333339AD74F681971A4ABA94F0D5383E3B9493953

Detection

Symbol obfuscation

Very low

2 malicious · 3 files

VBS6ad998bd6bccefde05e871bcb73d6488

VBS6ad998bd6bccefde05e871bcb73d6488.deobfuscated.vbs

BIN[Base64-Block]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105

Shape scr:vbs

malicious 1 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

6ad998bd6bccefde05e871bcb73d6488

Overview

Summary by MalvaGPT

Characteristics

File Structure

Malware Configuration — URLs (trace COM)1

Malware Configuration — URLs in PowerShell1

Artefacts2