Malicious
VBScript
MD5: 8c2b7bb8a2959eaf99e1d757f1962e20
Size: 135.74 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 132.6 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 4703ad7b5ea835ca9c90bef70aae937eb4db88885cd618e0d201d50fb126f094
- MD5
- 8c2b7bb8a2959eaf99e1d757f1962e20
- Verdict
- Malicious
- File type
- VBScript · 132.6 KB
Cite this report: https://app.malva.re/sha256/4703ad7b5ea835ca9c90bef70aae937eb4db88885cd618e0d201d50fb126f094
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
135.74 KB · 135,735 B
Hashes
MD5
8c2b7bb8a2959eaf99e1d757f1962e20
Sha1
49f827fb108bd0e3fa48d66c25561af862c9765f
Sha256
4703ad7b5ea835ca9c90bef70aae937eb4db88885cd618e0d201d50fb126f094
Sha384
67ad4cee551f11bf1f3e86f20a0c639baf759dc228c90beaf07003c34e5df06dba9adb086f58cf0c7c6cf2d32233629a
Sha512
0d5f05023e1054317c0c6757f8716979dd7c99249387a577af3c36af82273972b28aa99880a767eb2fc67775442229460b1eeaf6ae2aa72ac9d19d498672267f
SSDeep
3072:dzzKMiqJ+2YmkomXcTo3fSLnXlzR5G1T1Mdg:xzKMvSomQoKLVzRcMdg
TLSH
2FD31C12B4CA2F350B4AE65F6F03045DC07B65998D21409C96FCE299F89A57CB7FB328
Detection
Symbol obfuscation
Low
8 malicious · 8 files
VBS8c2b7bb8a2959eaf99e1d757f1962e20T1027 · T1059.001 · T1059.005
VBS8c2b7bb8a2959eaf99e1d757f1962e20.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential