Malicious
8e31c4951a7f404bcaa2bdeb3d7249b9
VBScript Encoded
MD5: 8e31c4951a7f404bcaa2bdeb3d7249b9
Size: 1.16 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 1.1 MB VBScript Encoded classified as malicious by Malva.RE. Static analysis extracted 39 embedded or derived files. It matches 15 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- e77d35be6d308d824d06258f6520bf71b600c6b47f09229f9cd0e3e588c12909
- MD5
- 8e31c4951a7f404bcaa2bdeb3d7249b9
- Verdict
- Malicious
- File type
- VBScript Encoded · 1.1 MB
Cite this report: https://app.malva.re/sha256/e77d35be6d308d824d06258f6520bf71b600c6b47f09229f9cd0e3e588c12909
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Encoded VBScript file
Size
1.16 MB · 1,164,425 B
First seen
2026-11-04 06:45 · 3 hours ago
Last seen
2026-11-04 06:45 · 3 hours ago
Last analysis
2026-11-04 06:45 · 3 hours ago
Hashes
MD5
8e31c4951a7f404bcaa2bdeb3d7249b9
Sha1
34c6f6d468e45cd1e01bb7ef29536320e56286cf
Sha256
e77d35be6d308d824d06258f6520bf71b600c6b47f09229f9cd0e3e588c12909
Sha384
8d7c888f0b897b24027acd2ea973ce7b176abcad556e624dc2dc895d6d425c687e32a97406a38478f85c3250df95eac5
Sha512
7d024c7b2f407077a27e02e322bb76ca4d8cd3ec7abed0d30e62277490c9b8f2847fac300e4ecf9ba703c8b945bc91af0b08a95ae5d81b64f6ea4f6e185e3dc5
SSDeep
24576:U2G/nvxW3Ww0tosMv1iD2djq2jRCZDJ88Rp:UbA30os3DjMMtZ
TLSH
AF454A02BE44CA11F0191633C3EF650487B4AC506AA6E72B7EB93B7E55123977C1CADB
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
5 malicious · 35 files
VBS8e31c4951a7f404bcaa2bdeb3d7249b9T1027 · T1059 · T1059.005
Structure
RAROverlay_effe1d09.bin
BATkPtojpvk6P2lJgx61nu1.bat
EXEbridgeperf.exe
Structure
BIN.Net Resources
BINkLpC7YXrhJ4GkBg9ei.4kw1H6kP46rXbK3oth
BINMnX1gBgEAi2jornJoF.jmkv5bsQpqRxJnpBhu
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
VBSbcnB5KHk3kn20MIklXtITT5c.vbe
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
VBS8e31c4951a7f404bcaa2bdeb3d7249b9.decoded.vbsT1027 · T1059 · T1059.005
VBS8e31c4951a7f404bcaa2bdeb3d7249b9.decoded.vbs.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
7 / 7
Path
pe:exe>arc:rar>pe:exe>pe:rsrc>bin
Shape
pe:exe>arc:rar>pe:exe>pe:rsrc>bin
malicious
5 nodes
Path
pe:exe>arc:rar>pe:exe>bin
Shape
pe:exe>arc:rar>pe:exe>bin
malicious
4 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_effe1d09.bin (848009 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |
Command (COM trace) #1
UNKNWOWNmalicious
C:/Revhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential5 malicious · 35 files
VBS8e31c4951a7f404bcaa2bdeb3d7249b9T1027 · T1059 · T1059.005
Structure
RAROverlay_effe1d09.bin
BATkPtojpvk6P2lJgx61nu1.bat
EXEbridgeperf.exe
Structure
BIN.Net Resources
BINResources
VBSbcnB5KHk3kn20MIklXtITT5c.vbe
BINResources
VBS8e31c4951a7f404bcaa2bdeb3d7249b9.decoded.vbsT1027 · T1059 · T1059.005
VBS8e31c4951a7f404bcaa2bdeb3d7249b9.decoded.vbs.deobfuscated.vbsT1059.005
No malware configuration was found at this point.
Command (COM trace) #1
UNKNWOWNmalicious
C:/Revhuhuhuhuhuhuhuhuhuhuhu
8e31c4951a7f404bcaa2bdeb3d7249b9 › 8e31c4951a7f404bcaa2bdeb3d7249b9.decoded.vbs
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
8e31c4951a7f404bcaa2bdeb3d7249b9 › 8e31c4951a7f404bcaa2bdeb3d7249b9.decoded.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account