Deep Malware Analysis of 95bf9a3d79496b9061d703aa625daa7d | md5: 95bf9a3d79496b9061d703aa625daa7d | PowerShell | Batch Command | PowerShell Call | SMTPControl.SMTP | Scripting.FileSystemObject | VBScript | DeObfuscated

Malicious

95bf9a3d79496b9061d703aa625daa7d.deobfuscated.vbs

Malicious

[Command #0]

Powershell: Hidden Execution

Batch Command

PowerShell Call

Malicious

[PowerShell Command]

Malicious

[Deobfuscated PS]

Malicious

[Base64-Block]

Malicious

[Deobfuscated PS]

Malicious

[Base64-Block]

[Deobfuscated PS]

Malicious

[PowerShell Command]

Scripting.FileSystemObject

Malicious

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Invokhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Invokhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$null huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Invokhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$null huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

95bf9a3d79496b9061d703aa625daa7d

VBScript

Malicious

95bf9a3d79496b9061d703aa625daa7d.deobfuscated.vbs

Malicious

[Command #0]

Powershell: Hidden Execution

Batch Command

PowerShell Call

Malicious

[PowerShell Command]

Malicious

[Deobfuscated PS]

Malicious

[Base64-Block]

Malicious

[Deobfuscated PS]

Malicious

[Base64-Block]

[Deobfuscated PS]

Malicious

[PowerShell Command]