Malicious
VBScript
MD5: 87bfb19bb0459757dd31e7154e0350e9
Size: 60.67 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 59.3 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- a2c7aa45450618ed116131bf595bb557676daa6200908ad62e2f3c6d1bab0e3d
- MD5
- 87bfb19bb0459757dd31e7154e0350e9
- Verdict
- Malicious
- File type
- VBScript · 59.3 KB
Cite this report: https://app.malva.re/sha256/a2c7aa45450618ed116131bf595bb557676daa6200908ad62e2f3c6d1bab0e3d
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
60.67 KB · 60,672 B
First seen
2026-11-02 07:15 · 2 hours ago
Last seen
2026-11-02 07:15 · 2 hours ago
Last analysis
2026-11-02 07:15 · 2 hours ago
Hashes
MD5
87bfb19bb0459757dd31e7154e0350e9
Sha1
e56667aa1bbee4064cb6c572a65e8e618dcc2050
Sha256
a2c7aa45450618ed116131bf595bb557676daa6200908ad62e2f3c6d1bab0e3d
Sha384
ec2eaea674bdbddcbefe2a764e1113558f6e18847c92d2305183d25b9228a9ce689267daf84c69485be5fc7d3f5a6cb8
Sha512
b2e220dbfdc990b9da50e169c935d944460acb31b42eaeabb8566ff6a749738a4358279f3965aaf4a7408714bd990d174ebf2e018e7cd2b91809ae6ba3422611
SSDeep
1536:csS6aD+/A+fuVVFM6Ah815fi/P5zXkkhGx5Ad9/o:csSCG5firhy5Ydo
TLSH
EF53B1E0BB1C331489E63F76D8458EA5AB2FC0C4C3122075799C6AD92C8B678E73B157
Detection
Symbol obfuscation
Medium
5 malicious · 6 files
VBS87bfb19bb0459757dd31e7154e0350e9T1027 · T1059.001 · T1059.005
VBS87bfb19bb0459757dd31e7154e0350e9.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential