Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 1.2 MB VBScript classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 4 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
69cfbb7d7969496884c320ed446bdd92dde50072960cbdbdbda9b235a3230bbe
MD5
8ef1946dde111355311f5563176653db
Verdict
Malicious
File type
VBScript · 1.2 MB
MITRE ATT&CK
T1027T1059T1059.005

Cite this report: https://app.malva.re/sha256/69cfbb7d7969496884c320ed446bdd92dde50072960cbdbdbda9b235a3230bbe

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
1.24 MB · 1,243,669 B
First seen
2026-10-27 13:45 · 4 days ago
Last seen
2026-10-27 13:45 · 4 days ago
Last analysis
2026-10-27 13:45 · 4 days ago
Hashes
MD5 8ef1946dde111355311f5563176653db Sha1 3fd19b614d3e1532eb03f8e9414e866de400723c Sha256 69cfbb7d7969496884c320ed446bdd92dde50072960cbdbdbda9b235a3230bbe Sha384 04bb0abdafb4ee2924661895af72cb24e16d84eb23ef61ec4a01a661aa1c0b6426965caf3e3a5d1d694fc391fc2e8dd0 Sha512 ef5518b753d61dc12ac639660a13bdaa81351c8cce8b84355fbb680b7d015e56a5f2c52a990629c210dd18b1418b6e0a3db2f5ba60b2b944ea0eb9a4c7bd2b93 SSDeep 24576:FAraIQByON1DVLGF/F+QiSOYw43/GPAvwNCu:uraIQBdfVEFh/Xu TLSH 0E45023884857FB85E3C3404987F1F852E600B97562AB949EF4A7DBB7BD6310872E4E4
Detection
Symbol obfuscation
Very low

2 malicious · 3 files
VBS8ef1946dde111355311f5563176653db
VBS8ef1946dde111355311f5563176653db.deobfuscated.vbs
EXE[Base64-Block @0x000403A3]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1059~T1059.005>pe:exe
Shape scr:vbs>pe:exe
malicious 2 nodes

Command (COM trace) #1 UNKNWOWNmalicious
ping -huhuhuhuhuhuhu
Command (COM trace) #2 UNKNWOWNmalicious
explorhuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1 PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

2 malicious · 3 files
VBS8ef1946dde111355311f5563176653db
VBS8ef1946dde111355311f5563176653db.deobfuscated.vbs
EXE[Base64-Block @0x000403A3]
No malware configuration was found at this point.

Command (COM trace) #1 UNKNWOWNmalicious
ping -huhuhuhuhuhuhu
8ef1946dde111355311f5563176653db
Command (COM trace) #2 UNKNWOWNmalicious
explorhuhuhuhuhuhuhuhuhuhuhu
8ef1946dde111355311f5563176653db
Dropped path (COM trace) #1 PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
8ef1946dde111355311f5563176653db
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
8ef1946dde111355311f5563176653db
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
8ef1946dde111355311f5563176653db › [Base64-Block @0x000403A3]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙