Malicious
8c2b7bb8a2959eaf99e1d757f1962e20
VBScript
MD5: 8c2b7bb8a2959eaf99e1d757f1962e20
Size: 135.74 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 132.6 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 4703ad7b5ea835ca9c90bef70aae937eb4db88885cd618e0d201d50fb126f094
- MD5
- 8c2b7bb8a2959eaf99e1d757f1962e20
- Verdict
- Malicious
- File type
- VBScript · 132.6 KB
Cite this report: https://app.malva.re/sha256/4703ad7b5ea835ca9c90bef70aae937eb4db88885cd618e0d201d50fb126f094
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
135.74 KB · 135,735 B
Hashes
MD5
8c2b7bb8a2959eaf99e1d757f1962e20
Sha1
49f827fb108bd0e3fa48d66c25561af862c9765f
Sha256
4703ad7b5ea835ca9c90bef70aae937eb4db88885cd618e0d201d50fb126f094
Sha384
67ad4cee551f11bf1f3e86f20a0c639baf759dc228c90beaf07003c34e5df06dba9adb086f58cf0c7c6cf2d32233629a
Sha512
0d5f05023e1054317c0c6757f8716979dd7c99249387a577af3c36af82273972b28aa99880a767eb2fc67775442229460b1eeaf6ae2aa72ac9d19d498672267f
SSDeep
3072:dzzKMiqJ+2YmkomXcTo3fSLnXlzR5G1T1Mdg:xzKMvSomQoKLVzRcMdg
TLSH
2FD31C12B4CA2F350B4AE65F6F03045DC07B65998D21409C96FCE299F89A57CB7FB328
Detection
Symbol obfuscation
Low
8 malicious · 8 files
VBS8c2b7bb8a2959eaf99e1d757f1962e20T1027 · T1059.001 · T1059.005
VBS8c2b7bb8a2959eaf99e1d757f1962e20.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential8 malicious · 8 files
VBS8c2b7bb8a2959eaf99e1d757f1962e20T1027 · T1059.001 · T1059.005
VBS8c2b7bb8a2959eaf99e1d757f1962e20.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
8c2b7bb8a2959eaf99e1d757f1962e20
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account