Malicious
918ad3516e0ef9d896bc75a31a81d86e
VBScript
MD5: 918ad3516e0ef9d896bc75a31a81d86e
Size: 7.56 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score
Medium
| MD5 | 918ad3516e0ef9d896bc75a31a81d86e |
| Sha1 | e3cb02771517a6001c23f5a3f8a5d8ef6761690b |
| Sha256 | df5ca1884dc8dd8514902293e21def2724b2d069c0bbce387747d843c4acd0c2 |
| Sha384 | f8909aaea278836ce84faed7c3f61d79ce5fae0d1eb7d62108b55cf0fd698c03438a3e3318e6ac2a1bce31727d329c97 |
| Sha512 | b5932cecd28f7198d10ed044d7032d840b51ca488067fc7f546d4538e8cbc4e276297c5dd793af30dafa2b3d9fb6ce78b025984e8bdf3f31243f713d4541d3e0 |
| SSDeep | 49152:OuKgLhKqcYxa1yZbtLfMRomdaARfM+1CjVUy4Jd/hvQRN0ynJT8rY7ANAWdFVFQ9:h |
| TLSH | 6276E0334A13BCEE3B7E2D84D4002D451C2C2E9797648658FB8835BB76E9294DF2E5B4 |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1027~T1059~T1059.005>pe:exe
Shape
scr:vbs>pe:exe
malicious
2 nodes
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #1
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #2
UNKNWOWNmalicious
"C:\Ushuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
net huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
No malware configuration was found at this point.
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
918ad3516e0ef9d896bc75a31a81d86e › [Base64-Block @0x000007A0]
Command (COM trace) #1
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
918ad3516e0ef9d896bc75a31a81d86e
Command (COM trace) #2
UNKNWOWNmalicious
"C:\Ushuhuhuhuhuhuhuhuhuhuhu
918ad3516e0ef9d896bc75a31a81d86e
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
918ad3516e0ef9d896bc75a31a81d86e
Deobfuscated PowerShell
UNKNWOWNmalicious
net huhuhuhuhuhuhu
918ad3516e0ef9d896bc75a31a81d86e › 918ad3516e0ef9d896bc75a31a81d86e.comtrace › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.