Malicious
6f1cac94ae8d19156d4e5b9195dbc3a8
VBScript
MD5: 6f1cac94ae8d19156d4e5b9195dbc3a8
Size: 15.29 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Corrupted Microsoft Office Document
Size
15.29 MB · 15,294,944 B
First seen
2026-07-11 07:01 · 3 months ago
Last seen
2026-07-11 07:01 · 3 months ago
Last analysis
2026-07-11 07:03 · 3 months ago
Hashes
MD5
6f1cac94ae8d19156d4e5b9195dbc3a8
Sha1
4650af8773928d573c84f4efe2930585cd1b4314
Sha256
34c37d16da934f0281861d55fd766ddac8e1860e9f62204bbb32cfb0052f51d7
Sha384
4656d222f96cac670f27d381c470465cb4df8e093d8a6037a276a7f3fae0a81f722f9e2f2a9f8b59dcc569bbbe85a2ff
Sha512
21cca66eb276a9051df15283df235b2416488af70b98c3c547cfcb79bac0b4d4486e962e7a64c1ff417d047d2725be504646ff9f617aa25f138371b51ec3ddee
SSDeep
196608:BISaERQ63Y74SD9KWUIOLFQSxnwldbNgtz8C:ZRf3gX97UIOLFCatQC
TLSH
C2F6D016650424AEC0EAC7768E27A417E736745573F1C9DB36AC8A0B0F27BD0EA3B711
Detection
PeID
Borland Delphi 4.0MASM/TASM - sig4 (h)Microsoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12Private EXE Protector V2.30-V2.3X -> SetiSoft TeamRPolyCryptor V1.4.2 -> Vaska
6 malicious · 60 files
VBS6f1cac94ae8d19156d4e5b9195dbc3a8
Structure
OFF[Repaired @0x005F7084]
PDFPDF @0x00000C1A
P7B[Authenticode]_b6408219.p7b
BINResources
BINRT_CURSOR
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINRT_BITMAP
BINID:0000
BINID:0
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINRT_STRING
BINID:0FEB
BINID:0
BINID:0FEC
BINID:0
BINID:0FED
BINID:0
BINID:0FEE
BINID:0
BINID:0FEF
BINID:0
BINID:0FF0
BINID:0
BINID:0FF1
BINID:0
BINID:0FF2
BINID:0
BINID:0FF3
BINID:0
BINID:0FF4
BINID:0
BINID:0FF5
BINID:0
BINID:0FF6
BINID:0
BINID:0FF7
BINID:0
BINID:0FF8
BINID:0
BINID:0FF9
BINID:0
BINID:0FFA
BINID:0
BINID:0FFB
BINID:0
BINID:0FFC
BINID:0
BINID:0FFD
BINID:0
BINID:0FFE
BINID:0
BINID:0FFF
BINID:0
BINID:1000
BINID:0
BINRT_RCDATA
BINID:0000
EXEID:1033
Structure
OFF[Repaired @0x0037F4F4]
PDFPDF @0x00000C1A
P7B[Authenticode]_e6cd8563.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
OFFPDF @0x0029C706
BINRT_GROUP_CURSOR2
BINID:7FF9
BINID:1033
BINID:7FFA
BINID:1033
BINID:7FFB
BINID:1033
BINID:7FFC
BINID:1033
BINID:7FFD
BINID:1033
BINID:7FFE
BINID:1033
BINID:7FFF
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
OFFPDF @0x00514296
| Name | Value |
|---|---|
| Info | Authenticode present at 0xE93208 size 12248 bytes |
6 malicious · 60 files
VBS6f1cac94ae8d19156d4e5b9195dbc3a8
Structure
OFF[Repaired @0x005F7084]
PDFPDF @0x00000C1A
P7B[Authenticode]_b6408219.p7b
BINResources
BINRT_CURSOR
BINRT_BITMAP
BINRT_ICON
BINRT_STRING
BINRT_RCDATA
BINID:0000
EXEID:1033
Structure
OFF[Repaired @0x0037F4F4]
PDFPDF @0x00000C1A
P7B[Authenticode]_e6cd8563.p7b
BINResources
OFFPDF @0x0029C706
BINRT_GROUP_CURSOR2
BINRT_GROUP_CURSOR4
BINRT_VERSION
BINRT_MANIFEST
OFFPDF @0x00514296
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account