Malicious
Malicious

7102bd6d266b10e4352070ff10e23640

VBScript
MD5: 7102bd6d266b10e4352070ff10e23640
Size: 1.35 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan

This sample is a 1.3 MB VBScript classified as malicious by Malva.RE. Static analysis extracted 4 embedded or derived files. It matches 7 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
78ea909c08497ac448e2e337ea2e9793c81147edd2eecd42b4c1fa77fd1c52b8
MD5
7102bd6d266b10e4352070ff10e23640
Verdict
Malicious
File type
VBScript · 1.3 MB
MITRE ATT&CK
T1027T1059.001T1059.005

Cite this report: https://app.malva.re/sha256/78ea909c08497ac448e2e337ea2e9793c81147edd2eecd42b4c1fa77fd1c52b8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
1.35 MB · 1,349,674 B
First seen
2026-07-25 11:16 · 3 months ago
Last seen
2026-07-25 11:16 · 3 months ago
Last analysis
2026-07-26 04:55 · 3 months ago
Hashes
MD5 7102bd6d266b10e4352070ff10e23640 Sha1 2a78928f437f27a1c3a2cf41d5ee5c4fa8ecfdde Sha256 78ea909c08497ac448e2e337ea2e9793c81147edd2eecd42b4c1fa77fd1c52b8 Sha384 709a7332ad1a3032ea8dd47ec82413fbe9627759786e728a1cf1667549af74cbed6d3353ffabce2d4bf4ba84fda45451 Sha512 de02f013446728e48b029e00d0f37e8003849319b9143875bf8d47cec1c5ca801a4a539e238a43e06fb0e9638eb3bcd905c2478b1d9a2dbdb491c5e58753b527 SSDeep 384:KKk6yoSFsU/lsxF/M/C21Y/uETTc/YC21s/OsFyFrY/uh6yoSFsU/i2/HsrFETT8:FCccs6 TLSH 47555227506A0DEDB90772F2AE489DED08F03B59F1E57951B65FA3C0603E082E067F66

5 malicious · 5 files
VBS7102bd6d266b10e4352070ff10e23640
BIN7102bd6d266b10e4352070ff10e23640.deobfuscated.vbs
SH[Command #0]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes

Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

5 malicious · 5 files
VBS7102bd6d266b10e4352070ff10e23640
BIN7102bd6d266b10e4352070ff10e23640.deobfuscated.vbs
SH[Command #0]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
No malware configuration was found at this point.

Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
7102bd6d266b10e4352070ff10e23640 › 7102bd6d266b10e4352070ff10e23640.deobfuscated.vbs › [Command #0]
Deobfuscated PowerShell UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
7102bd6d266b10e4352070ff10e23640 › 7102bd6d266b10e4352070ff10e23640.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙