Malicious
863de75912d81fb93a9c2815a1742c91
VBScript
MD5: 863de75912d81fb93a9c2815a1742c91
Size: 3.06 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score
Very high
| MD5 | 863de75912d81fb93a9c2815a1742c91 |
| Sha1 | 56455bc07456a9dde9dfc27d2fda07d40f6b14b9 |
| Sha256 | fc2ec0fb4a247677fbea2da2becbc8c29763e68a9bbb51edc6b97d0c9dc1f9bc |
| Sha384 | d0c304eb165c2ccfea44813362b4d999f5d583fef40ce46158f4753fb9efbb217c648b1d8d674bd616356a2f36a7b39c |
| Sha512 | d8d6ed80e0ffab5e1815d9e25022582765dd539b9267cb7426fd81ca24d8cf20c558957bda92f9ba27a47bf5a04a66c9eee9159faf3e3ffd635b6652dda5759c |
| SSDeep | 48:2ODKB4+AN+oLkqfOjI7roJqH9poESNM8V82dlM8WlPvNx76:2ODKB4+A4oo/U7kOpoESNM8FM8WlNxO |
| TLSH | E951E823BC0BD1E68533C862784F201EE87D5B13196428E6BB9C94C53FB965862EE25C |
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #2
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #3
UNKNWOWNmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
htthuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
mkdir huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
863de75912d81fb93a9c2815a1742c91
Command (COM trace) #2
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
863de75912d81fb93a9c2815a1742c91
Command (COM trace) #3
UNKNWOWNmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
863de75912d81fb93a9c2815a1742c91
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
863de75912d81fb93a9c2815a1742c91
URLs in VB Code - #1
URIsuspect
htthuhuhuhu
863de75912d81fb93a9c2815a1742c91
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
863de75912d81fb93a9c2815a1742c91
Deobfuscated PowerShell
UNKNWOWNmalicious
mkdir huhuhuhuhuhuhuhuhuhuhu
863de75912d81fb93a9c2815a1742c91 › 863de75912d81fb93a9c2815a1742c91.comtrace › [Command #2] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.