Malicious
94e9b11457764b33ba60c7da12489aea
VBScript
MD5: 94e9b11457764b33ba60c7da12489aea
Size: 188.89 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 184.5 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 654c289d639c01e2ce1fcb1e26e8f0449406a2ccba8dad95074e1b4ce6299303
- MD5
- 94e9b11457764b33ba60c7da12489aea
- Verdict
- Malicious
- File type
- VBScript · 184.5 KB
Cite this report: https://app.malva.re/sha256/654c289d639c01e2ce1fcb1e26e8f0449406a2ccba8dad95074e1b4ce6299303
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
188.89 KB · 188,891 B
First seen
2026-11-04 11:00 · 2 hours ago
Last seen
2026-11-04 11:00 · 2 hours ago
Last analysis
2026-11-04 11:01 · 2 hours ago
Hashes
MD5
94e9b11457764b33ba60c7da12489aea
Sha1
c438511d5a20e67c840512f114b104f675cc733a
Sha256
654c289d639c01e2ce1fcb1e26e8f0449406a2ccba8dad95074e1b4ce6299303
Sha384
38d8fc3dc594774ff4f7b69757153aed3d1480f3be5e9373782016d70c4997c5c02369a65d4f7d9269e21dc87bebdb01
Sha512
2ae846257e95177e60e1d819e00a81e43b0450b37ea1ba3a59e76cb6ab993e47bb69cc8abe2181b0e87ce7e9c5655d21479a7b0b64f350afd974666f512a04b9
SSDeep
3072:B0CymWEjrlQAejFA5bO8neBw3O0S8zlsT8FRuTAMvilgJ2Zqi3ijjY2mij3ACz8/:BjhOpjFAbO8nem3ZS8zlEORuTAMvilgY
TLSH
F704F163FE991501A43CA20AF9569C12CD104BF28F5536243E8D95BC1BF02377FAD6D6
Detection
Symbol obfuscation
Low
3 malicious · 3 files
VBS94e9b11457764b33ba60c7da12489aeaT1027 · T1059.005
VBS94e9b11457764b33ba60c7da12489aea.deobfuscated.vbsT1059.005
BIN.executed
VBS.subscript.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.005
Shape
scr:vbs
malicious
1 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 3 files
VBS94e9b11457764b33ba60c7da12489aeaT1027 · T1059.005
VBS94e9b11457764b33ba60c7da12489aea.deobfuscated.vbsT1059.005
BIN.executed
VBS.subscript.vbsT1059.005
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
94e9b11457764b33ba60c7da12489aea
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account