Malicious
Malicious

87bfb19bb0459757dd31e7154e0350e9

VBScript
MD5: 87bfb19bb0459757dd31e7154e0350e9
Size: 60.67 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan

This sample is a 59.3 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a2c7aa45450618ed116131bf595bb557676daa6200908ad62e2f3c6d1bab0e3d
MD5
87bfb19bb0459757dd31e7154e0350e9
Verdict
Malicious
File type
VBScript · 59.3 KB
MITRE ATT&CK
T1027T1059.001T1059.005

Cite this report: https://app.malva.re/sha256/a2c7aa45450618ed116131bf595bb557676daa6200908ad62e2f3c6d1bab0e3d

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
60.67 KB · 60,672 B
First seen
2026-11-02 07:15 · 2 hours ago
Last seen
2026-11-02 07:15 · 2 hours ago
Last analysis
2026-11-02 07:15 · 2 hours ago
Hashes
MD5 87bfb19bb0459757dd31e7154e0350e9 Sha1 e56667aa1bbee4064cb6c572a65e8e618dcc2050 Sha256 a2c7aa45450618ed116131bf595bb557676daa6200908ad62e2f3c6d1bab0e3d Sha384 ec2eaea674bdbddcbefe2a764e1113558f6e18847c92d2305183d25b9228a9ce689267daf84c69485be5fc7d3f5a6cb8 Sha512 b2e220dbfdc990b9da50e169c935d944460acb31b42eaeabb8566ff6a749738a4358279f3965aaf4a7408714bd990d174ebf2e018e7cd2b91809ae6ba3422611 SSDeep 1536:csS6aD+/A+fuVVFM6Ah815fi/P5zXkkhGx5Ad9/o:csSCG5firhy5Ydo TLSH EF53B1E0BB1C331489E63F76D8458EA5AB2FC0C4C3122075799C6AD92C8B678E73B157
Detection
Symbol obfuscation
Medium

5 malicious · 6 files
VBS87bfb19bb0459757dd31e7154e0350e9
VBS87bfb19bb0459757dd31e7154e0350e9.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
BIN[Base64-Block]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:ps1
malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

5 malicious · 6 files
VBS87bfb19bb0459757dd31e7154e0350e9
VBS87bfb19bb0459757dd31e7154e0350e9.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
BIN[Base64-Block]
No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
87bfb19bb0459757dd31e7154e0350e9
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙