Malicious
815c3281cf31f1a5b867d588358dedda
ZIP Archive
MD5: 815c3281cf31f1a5b867d588358dedda
Size: 3.04 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
3.04 KB · 3,039 B
First seen
2026-09-06 19:45 · one month ago
Last seen
2026-09-06 19:45 · one month ago
Last analysis
2026-09-06 19:45 · one month ago
Hashes
MD5
815c3281cf31f1a5b867d588358dedda
Sha1
8fe5c16f42628757d201d24f8d14b6dd157cddc9
Sha256
6eaa66cfe3d62cf967dece46f8a6851dd2c6cc71521f7ec57b30ea4c1ac295f3
Sha384
3fbf6a91cb103829578621eb95f50f221fcfae13d3904f1ed6b58562e2fa654b9bccf242d51e4f7176c54bd16f3dd49b
Sha512
4bbeb2cb378b993fada72ee54439ac401752ca8a7d132582b2acad1f4a8167ca90cbde6dc25b6f1b4e8d4fe657621ed93412380edabf401866b37f6c8360dff6
SSDeep
48:9NyDXYHsggT7pbvxpEqi3jj8ddALhn27YkLpcdAjchnDFXzWdLBYndAlSA6o:3yDXYDg3NvxppiErv448OSy
TLSH
B85185579E16CD28E86F16238EBEED2E3D3C001FAF51C482E07D8E5435947B4539650B
Detection
Symbol obfuscation
Low
10 malicious · 10 files
ZIP815c3281cf31f1a5b867d588358deddaT1027 · T1059 · T1105
VBS815c3281cf31f1a5b867d588358dedda.deobfuscated.vbsT1059.005
SH[Command #0] T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
SH[Command #1] T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
VBSDocument-52848.pdf .vbs T1027 · T1059 · T1059.005
VBSDocument-52848.pdf .vbs .deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
arc:zip~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001~T1105
Shape
arc:zip>scr:bat>scr:ps1
malicious
3 nodes
Path
arc:zip~T1027~T1059~T1059.005>scr:vbs~T1027~T1059~T1059.005
Shape
arc:zip>scr:vbs
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCommand (COM trace) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #2
UNKNWOWNmalicious
"C:\Ushuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #3
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #4
UNKNWOWNmalicious
cscriphuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
curl huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
curl huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential10 malicious · 10 files
ZIP815c3281cf31f1a5b867d588358deddaT1027 · T1059 · T1105
VBS815c3281cf31f1a5b867d588358dedda.deobfuscated.vbsT1059.005
SH[Command #0] T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
SH[Command #1] T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
VBSDocument-52848.pdf .vbs T1027 · T1059 · T1059.005
VBSDocument-52848.pdf .vbs .deobfuscated.vbsT1059.005
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCommand (COM trace) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda
Command (COM trace) #2
UNKNWOWNmalicious
"C:\Ushuhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda
Command (COM trace) #3
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda
Command (COM trace) #4
UNKNWOWNmalicious
cscriphuhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda › 815c3281cf31f1a5b867d588358dedda.deobfuscated.vbs › [Command #1] › [PowerShell Command]
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda › 815c3281cf31f1a5b867d588358dedda.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda › Document-52848.pdf .vbs
Deobfuscated PowerShell
UNKNWOWNmalicious
curl huhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda › 815c3281cf31f1a5b867d588358dedda.deobfuscated.vbs › [Command #1] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
curl huhuhuhuhuhuhuhuhuhuhu
815c3281cf31f1a5b867d588358dedda › 815c3281cf31f1a5b867d588358dedda.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account