Deep Malware Analysis of 863de75912d81fb93a9c2815a1742c91 | md5: 863de75912d81fb93a9c2815a1742c91 | SOS: 0.80 | WScript.Shell | Scripting.FileSystemObject | Shell.Application | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | PowerShell | Batch Command | PowerShell Call | T1059 | COM Behavior Trace | T1059.001

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	863de75912d81fb93a9c2815a1742c91
Sha1	56455bc07456a9dde9dfc27d2fda07d40f6b14b9
Sha256	fc2ec0fb4a247677fbea2da2becbc8c29763e68a9bbb51edc6b97d0c9dc1f9bc
Sha384	d0c304eb165c2ccfea44813362b4d999f5d583fef40ce46158f4753fb9efbb217c648b1d8d674bd616356a2f36a7b39c
Sha512	d8d6ed80e0ffab5e1815d9e25022582765dd539b9267cb7426fd81ca24d8cf20c558957bda92f9ba27a47bf5a04a66c9eee9159faf3e3ffd635b6652dda5759c
SSDeep	48:2ODKB4+AN+oLkqfOjI7roJqH9poESNM8V82dlM8WlPvNx76:2ODKB4+A4oo/U7kOpoESNM8FM8WlNxO
TLSH	E951E823BC0BD1E68533C862784F201EE87D5B13196428E6BB9C94C53FB965862EE25C

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001

Shape scr:vbs>scr:bat>scr:ps1

malicious 3 nodes

Config. Field	Value
URL (COM trace) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

C:\Winhuhuhuhuhuhuhuhuhuhuhu

Command (COM trace) #2 UNKNWOWNmalicious

cmd /chuhuhuhuhuhuhuhuhuhuhu

Command (COM trace) #3 UNKNWOWNmalicious

C:\Winhuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

htthuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

mkdir huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential