Malicious
81b19e2c8ea96ad174470d0cad5413c1
VBScript
MD5: 81b19e2c8ea96ad174470d0cad5413c1
Size: 1.03 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 81b19e2c8ea96ad174470d0cad5413c1 |
| Sha1 | 2480528f7795c7912c20ed630e9964ca0e2bd0fc |
| Sha256 | e31eb79d46005feb7fbf905c3230f20514fca537fa7ba4cc241d40a944ebc094 |
| Sha384 | 24738ffe87d124ea232c6bd03b13943faef9344bcd99ba311a94e7d36ce6793ce92ae10aec41776b05202c861b94c04d |
| Sha512 | 8aa33b0beefc422d6faca74cbeac61ca3f38238e0e706ddfcc598d1c9de361bfa2697322e4e31eb02dfbabd1049816bf427b50316ab9a861c760d479d2945fca |
| SSDeep | 12288:O6UuaXe8xZ7uF86UuaXe8xZ7uFqIz6UuaXe8xZ7uFw:ZUZLoDUZLoyUZLow |
| TLSH | CE25D1CAB98D3504AC5D31F538345E61EADC83C0A341EBB2EE35C66371C646CAE6B791 |
Malicious
Malicious
Malicious
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$null huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$null huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
Malicious
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
81b19e2c8ea96ad174470d0cad5413c1
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
81b19e2c8ea96ad174470d0cad5413c1 › 81b19e2c8ea96ad174470d0cad5413c1.deobfuscated.vbs › [Command #0]
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
81b19e2c8ea96ad174470d0cad5413c1 › 81b19e2c8ea96ad174470d0cad5413c1.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
81b19e2c8ea96ad174470d0cad5413c1 › 81b19e2c8ea96ad174470d0cad5413c1.deobfuscated.vbs › [Command #0] › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
$null huhuhuhuhuhuhuhuhuhuhu
81b19e2c8ea96ad174470d0cad5413c1 › 81b19e2c8ea96ad174470d0cad5413c1.deobfuscated.vbs › [Command #0] › [Base64-Block]
Deobfuscated PowerShell
UNKNWOWNmalicious
$null huhuhuhuhuhuhuhuhuhuhu
81b19e2c8ea96ad174470d0cad5413c1 › 81b19e2c8ea96ad174470d0cad5413c1.deobfuscated.vbs › [Command #0] › [Base64-Block] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
81b19e2c8ea96ad174470d0cad5413c1 › 81b19e2c8ea96ad174470d0cad5413c1.deobfuscated.vbs › [Command #0] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
81b19e2c8ea96ad174470d0cad5413c1 › 81b19e2c8ea96ad174470d0cad5413c1.deobfuscated.vbs › [Command #0] › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.