Suspicious
Suspect

885e153ed113c7cff48e7c2b1f36f4bf

VBScript
MD5: 885e153ed113c7cff48e7c2b1f36f4bf
Size: 1.64 MB
text/vbscript

This sample is a 1.6 MB VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 102 embedded or derived files. It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
98e1148702ac936aa1451b8d25edfd125e3ebb2cedff209bd777e2eb1d2a01d1
MD5
885e153ed113c7cff48e7c2b1f36f4bf
Verdict
Inconclusive
File type
VBScript · 1.6 MB

Cite this report: https://app.malva.re/sha256/98e1148702ac936aa1451b8d25edfd125e3ebb2cedff209bd777e2eb1d2a01d1

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
1.64 MB · 1,644,544 B
First seen
2026-10-23 19:15 · 3 days ago
Last seen
2026-10-23 19:15 · 3 days ago
Last analysis
2026-10-23 19:15 · 3 days ago
Hashes
MD5 885e153ed113c7cff48e7c2b1f36f4bf Sha1 50bc77b546bdd09b2e04d72bdf70b30e762ebb23 Sha256 98e1148702ac936aa1451b8d25edfd125e3ebb2cedff209bd777e2eb1d2a01d1 Sha384 a8fd3b2f287288cd7977514b082e9d53abbacf42a82f42b8d44fac6fa9e4b00b7852cf7a129978f5e5447f43f0bff988 Sha512 f211e34b1edf21b458dda84e59ca92e730695177faba6be12aae1f5d074c54c4ba2a8cad19a9f1cb9175e223e4fb2fa73bab66eefa6873778b6e37b8ac174a8b SSDeep 24576:GyTZkcqFS97chghpaDuKu+5XSBWoI1jLjCXoHo7kxFl2WUpS6Iz0Pi:GTcqFS97mg+TLll/VI7kvgtDO TLSH 2F75E10A17E95AA8F0BF9B38A77801A807F0B967D721E75F3D4901DD8D21B86D642373
Detection
Symbol obfuscation
Very high

103 files
VBS885e153ed113c7cff48e7c2b1f36f4bf
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINTf6q1PmzH_o70i.g.resources
BINTf6q1PmzH_o70i.Resources.resources
BIN4e3eeb5419529d.Resources.resources
BIN62f4539e0
DATA[NBF]root.Data
BIN62f4539e1
DATA[NBF]root.Data
BIN62f4539e10
DATA[NBF]root.Data
BIN62f4539e11
DATA[NBF]root.Data
BIN62f4539e12
DATA[NBF]root.Data
BIN62f4539e13
DATA[NBF]root.Data
BIN62f4539e14
DATA[NBF]root.Data
BIN62f4539e15
DATA[NBF]root.Data
BIN62f4539e16
DATA[NBF]root.Data
BIN62f4539e17
DATA[NBF]root.Data
BIN62f4539e18
DATA[NBF]root.Data
BIN62f4539e19
DATA[NBF]root.Data
BIN62f4539e2
DATA[NBF]root.Data
BIN62f4539e20
DATA[NBF]root.Data
BIN62f4539e21
DATA[NBF]root.Data
BIN62f4539e22
DATA[NBF]root.Data
BIN62f4539e23
DATA[NBF]root.Data
BIN62f4539e24
DATA[NBF]root.Data
BIN62f4539e25
DATA[NBF]root.Data
BIN62f4539e26
DATA[NBF]root.Data
BIN62f4539e27
DATA[NBF]root.Data
BIN62f4539e28
DATA[NBF]root.Data
BIN62f4539e29
DATA[NBF]root.Data
BIN62f4539e3
DATA[NBF]root.Data
BIN62f4539e30
DATA[NBF]root.Data
BIN62f4539e31
DATA[NBF]root.Data
BIN62f4539e32
DATA[NBF]root.Data
BIN62f4539e33
DATA[NBF]root.Data
BIN62f4539e34
DATA[NBF]root.Data
BIN62f4539e35
DATA[NBF]root.Data
BIN62f4539e36
DATA[NBF]root.Data
BIN62f4539e37
DATA[NBF]root.Data
BIN62f4539e38
DATA[NBF]root.Data
BIN62f4539e39
DATA[NBF]root.Data
BIN62f4539e4
DATA[NBF]root.Data
BIN62f4539e40
DATA[NBF]root.Data
BIN62f4539e41
DATA[NBF]root.Data
BIN62f4539e42
DATA[NBF]root.Data
BIN62f4539e43
DATA[NBF]root.Data
BIN62f4539e44
DATA[NBF]root.Data
BIN62f4539e45
DATA[NBF]root.Data
BIN62f4539e46
DATA[NBF]root.Data
BIN62f4539e47
DATA[NBF]root.Data
BIN62f4539e48
DATA[NBF]root.Data
BIN62f4539e5
DATA[NBF]root.Data
BIN62f4539e6
DATA[NBF]root.Data
BIN62f4539e7
DATA[NBF]root.Data
BIN62f4539e8
DATA[NBF]root.Data
BIN62f4539e9
DATA[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Module Name
Tf6q1PmzH_o70i
Full Name
Tf6q1PmzH_o70i
EntryPoint
System.Void Tf6q1PmzH_o70i.Gy2aeQf::Sq6pkWe7w4L()
Scope Name
Tf6q1PmzH_o70i
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tf6q1PmzH_o70i
Assembly Version
4.2.30.295
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1611
Main Method
System.Void Tf6q1PmzH_o70i.Gy2aeQf::Sq6pkWe7w4L()
Main IL Instruction Count
290
Main IL 
nop <null>
newobj System.Void Tf6q1PmzH_o70i.Gop9o6jS5::.ctor()
stloc.0 <null>
newobj System.Void System.RankException::.ctor()
stloc.1 <null>
nop <null>
newobj System.Void System.Random::.ctor()
stloc.2 <null>
ldloc.2 <null>
ldc.i4.s 20
ldc.i4 500
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stloc.3 <null>
ldc.i4.0 <null>
stloc.s V_4
br IL_029B: ldc.i4.1
ldloc.3 <null>
ldc.i4.2 <null>
rem <null>
brtrue.s IL_0036: ldc.i4.0
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
br.s IL_0037: stloc.s V_9
ldc.i4.0 <null>
stloc.s V_9
ldloc.s V_9
brfalse IL_00E1: ldloc.3
call System.Guid System.Guid::NewGuid()
stloc.s V_16
ldloca.s V_16
ldstr N
call System.String System.Guid::ToString(System.String)
stloc.s V_10
call System.Int32 System.Environment::get_ProcessorCount()
stloc.s V_11
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.s V_12
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.s V_6
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.String System.Version::ToString()
stloc.s V_13
ldc.r8 24
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.s V_14
ldloc.s V_14
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_7
ldtoken Tf6q1PmzH_o70i.Gop9o6jS5
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
newobj System.Void System.Object::.ctor()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.ComponentModel.License System.ComponentModel.LicenseManager::Validate(System.Type,System.Object)
stloc.s V_15
ldloc.s V_4
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_4
nop <null>
br IL_029A: nop
ldloc.3 <null>
ldc.i4.3 <null>
rem <null>
brtrue.s IL_00ED: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
ceq <null>
br.s IL_00EE: stloc.s V_17
ldc.i4.0 <null>
stloc.s V_17
ldloc.s V_17
brfalse.s IL_012A: ldloc.3
ldc.i4.s 25
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr AppSysyyrasd
ldstr sdfret4fdg
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_18
ldloc.s V_18
call System.Boolean System.IO.Directory::Exists(System.String)
stloc.s V_19
ldloc.s V_7
castclass System.Object[]
stloc.s V_5
ldloc.s V_4
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_4
nop <null>
br IL_029A: nop
ldloc.3 <null>
ldc.i4.5 <null>
rem <null>
brtrue.s IL_0136: ldc.i4.0
ldloc.s V_4
ldc.i4.2 <null>
ceq <null>
br.s IL_0137: stloc.s V_20
ldc.i4.0 <null>
stloc.s V_20
ldloc.s V_20
brfalse.s IL_0182: ldloc.3
ldstr {0}/{1}.{2}
stloc.s V_21
ldloc.s V_21
ldstr resources
ldstr saaremoghadam
ldstr mov
call System.String System.String::Format(System.String,System.Object,System.Object,System.Object)
stloc.s V_8
ldloc.s V_5
ldc.i4.0 <null>
ldloc.s V_8
stelem.ref <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.s V_8
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
ldc.i4.0 <null>
call System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)
stloc.s V_22
ldloc.s V_4
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_4
nop <null>
br IL_029A: nop
ldloc.3 <null>
ldc.i4.7 <null>
rem <null>
brtrue.s IL_018E: ldc.i4.0
ldloc.s V_4
ldc.i4.3 <null>
ceq <null>
br.s IL_018F: stloc.s V_23
ldc.i4.0 <null>
stloc.s V_23
ldloc.s V_23
brfalse.s IL_01E3: ldloc.3
ldloc.s V_5
ldc.i4.2 <null>
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Byte[] Tf6q1PmzH_o70i.td5A2kRpG7tf::Ne1wb7Kf3(System.String)
stelem.ref <null>
ldloc.s V_5
ldc.i4.2 <null>
ldelem.ref <null>
isinst System.Byte[]
brtrue.s IL_01B5: ldloc.s V_5
ldc.i4.0 <null>
br.s IL_01C0: stloc.s V_24
ldloc.s V_5
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
ldlen <null>
conv.i4 <null>
stloc.s V_24
ldloc.s V_5
ldc.i4.3 <null>
ldloc.s V_5
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] Tf6q1PmzH_o70i.Qe4_6::5krCE(System.Byte[])
stelem.ref <null>
ldc.i4.1 <null>
stloc.s V_25
ldloc.s V_4
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_4
nop <null>
br IL_029A: nop
ldloc.3 <null>
ldc.i4.s 9
rem <null>
brtrue.s IL_01F0: ldc.i4.0
ldloc.s V_4
ldc.i4.4 <null>
ceq <null>
br.s IL_01F1: stloc.s V_26
ldc.i4.0 <null>
stloc.s V_26
ldloc.s V_26
brfalse IL_028A: nop
ldc.i4.3 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr ModuleName
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr L o a d
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr ListIndex
stelem.ref <null>
stloc.s V_27
newobj System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::.ctor()
stloc.s V_29
ldloc.s V_29
ldloc.s V_27
ldc.i4.0 <null>
ldelem.ref <null>
ldloc.s V_27
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_29
ldloc.s V_27
ldc.i4.2 <null>
ldelem.ref <null>
ldc.i4.3 <null>
box System.Int32
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_29
stloc.s V_28
ldloc.s V_28
ldloc.s V_27
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldloc.s V_5
ldloc.s V_28
ldloc.s V_27
ldc.i4.2 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.Object)
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Double Tf6q1PmzH_o70i.Di4xejW2Sg5d8::gCc10kXgq(System.String,System.Object)
ldc.r8 0
cgt <null>
stloc.s V_30
ldloc.s V_30
brfalse.s IL_0287: nop
br.s IL_02A3: leave.s IL_02C4
nop <null>
br.s IL_02A3: leave.s IL_02C4
nop <null>
ldloc.2 <null>
ldc.i4.s 20
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stloc.3 <null>
nop <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_31
br IL_002A: ldloc.3
leave.s IL_02C4: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_32
nop <null>
ldloc.s V_32
callvirt System.String System.Exception::ToString()
ldc.i4.0 <null>
ldnull <null>
call Microsoft.VisualBasic.MsgBoxResult Microsoft.VisualBasic.Interaction::MsgBox(System.Object,Microsoft.VisualBasic.MsgBoxStyle,System.Object)
pop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02C4: nop
nop <null>
ret <null>

103 files
VBS885e153ed113c7cff48e7c2b1f36f4bf
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙