Malicious
VBScript
MD5: 8ef1946dde111355311f5563176653db
Size: 1.24 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 1.2 MB VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 2 embedded or derived files. It matches 4 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 69cfbb7d7969496884c320ed446bdd92dde50072960cbdbdbda9b235a3230bbe
- MD5
- 8ef1946dde111355311f5563176653db
- Verdict
- Malicious
- File type
- VBScript · 1.2 MB
Cite this report: https://app.malva.re/sha256/69cfbb7d7969496884c320ed446bdd92dde50072960cbdbdbda9b235a3230bbe
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
1.24 MB · 1,243,669 B
First seen
2026-10-27 13:45 · 4 days ago
Last seen
2026-10-27 13:45 · 4 days ago
Last analysis
2026-10-27 13:45 · 4 days ago
Hashes
MD5
8ef1946dde111355311f5563176653db
Sha1
3fd19b614d3e1532eb03f8e9414e866de400723c
Sha256
69cfbb7d7969496884c320ed446bdd92dde50072960cbdbdbda9b235a3230bbe
Sha384
04bb0abdafb4ee2924661895af72cb24e16d84eb23ef61ec4a01a661aa1c0b6426965caf3e3a5d1d694fc391fc2e8dd0
Sha512
ef5518b753d61dc12ac639660a13bdaa81351c8cce8b84355fbb680b7d015e56a5f2c52a990629c210dd18b1418b6e0a3db2f5ba60b2b944ea0eb9a4c7bd2b93
SSDeep
24576:FAraIQByON1DVLGF/F+QiSOYw43/GPAvwNCu:uraIQBdfVEFh/Xu
TLSH
0E45023884857FB85E3C3404987F1F852E600B97562AB949EF4A7DBB7BD6310872E4E4
Detection
Symbol obfuscation
Very low
2 malicious · 3 files
VBS8ef1946dde111355311f5563176653dbT1027 · T1059 · T1059.005
VBS8ef1946dde111355311f5563176653db.deobfuscated.vbsT1059.005
EXE[Base64-Block @0x000403A3]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005>pe:exe
Shape
scr:vbs>pe:exe
malicious
2 nodes
Command (COM trace) #1
UNKNWOWNmalicious
ping -huhuhuhuhuhuhu
Command (COM trace) #2
UNKNWOWNmalicious
explorhuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential