Malicious
VBScript
MD5: 83ba7e5690f83f37d8f06546a4bf5822
Size: 3.37 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
3.37 KB · 3,373 B
First seen
2026-10-25 11:15 · 11 hours ago
Last seen
2026-10-25 11:15 · 11 hours ago
Last analysis
2026-10-25 11:15 · 11 hours ago
Hashes
MD5
83ba7e5690f83f37d8f06546a4bf5822
Sha1
923a112fe5711da70d20fbbf43f07fafb99a512f
Sha256
04c2b55a1569c231af1c2f32aa264b157d85edbb51006f6bf532d4dbc58b16bd
Sha384
331305a93d30b33414693773b1e9a940af8ef1b7cb37707c087f1289eb361217fd8c8d5e00923f82220e75d1989a22cc
Sha512
718bb85c848adb5a4b8927aed597a46fa116e2203e00b4145d07e0c173bd1c3f04635ae180d3e055d1e4300f6055fc2c3abc34dfe57c90b1c3e6c20f670b11ef
SSDeep
96:NGaSGf5Ud5sXZlfwvb8EstCgDlTpn3f2N/X6dGo:0aZjXHfPPCc93f2kGo
TLSH
B361820B7D4B41629879C1078A1B3E5BDBD3135B161000A9F6AD98492F317AFC6FD1A3
Detection
Symbol obfuscation
Medium
5 malicious · 5 files
VBS83ba7e5690f83f37d8f06546a4bf5822T1027 · T1059 · T1105
VBS83ba7e5690f83f37d8f06546a4bf5822.deobfuscated.vbsT1059.005
SH[Command #0] T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001~T1105
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCommand (COM trace) #1
UNKNWOWNmalicious
wschuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"[Net.huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential