Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 4 MB VBScript classified as malicious by Malva.RE. Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
54333f3f6e442e80da7724c040c4a787fc034471221b5e3c074891a035b6c2b3
MD5
9354c209358a936a91a4f4725a21e057
Verdict
Malicious
File type
VBScript · 4 MB
MITRE ATT&CK
T1027T1059T1059.005

Cite this report: https://app.malva.re/sha256/54333f3f6e442e80da7724c040c4a787fc034471221b5e3c074891a035b6c2b3

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
4.22 MB · 4,222,178 B
First seen
2026-10-26 14:15 · 10 hours ago
Last seen
2026-10-26 14:15 · 10 hours ago
Last analysis
2026-10-26 14:15 · 10 hours ago
Hashes
MD5 9354c209358a936a91a4f4725a21e057 Sha1 af66945bf3032d189205a8a64c1dd5dff919a397 Sha256 54333f3f6e442e80da7724c040c4a787fc034471221b5e3c074891a035b6c2b3 Sha384 e714653f286ab97eb536b1006b903b1cee0c93a6cbb7fb62931fe09db0a6af5b3c05bd38387467f2367f1a88cb75f5a5 Sha512 5b25c25a5e5a527e84a1633e25683576f800ad9474f7ea13e6efea1c5708a49c328e9f55d278d3a0ef4e00beab7585ba93da37bd2fb86fb49cdd906853d73a96 SSDeep 49152:Hhhdarqj07sHsqTqyr7DH5UFoiaB/mjVwpU2bj0dwJrS3:Q TLSH 6E161237EBA5051709A1077AF00B6273BF67C823874D82B5CC9DE22535DB4EAC27E5A4
Detection
Symbol obfuscation
High

2 malicious · 2 files
VBS9354c209358a936a91a4f4725a21e057
VBS9354c209358a936a91a4f4725a21e057.deobfuscated.vbs
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1059~T1059.005
Shape scr:vbs
malicious 1 nodes

Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

2 malicious · 2 files
VBS9354c209358a936a91a4f4725a21e057
VBS9354c209358a936a91a4f4725a21e057.deobfuscated.vbs
No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
9354c209358a936a91a4f4725a21e057
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙