Suspicious
Suspect

96ae8c7e95898f16c8ba3ffc8c5c2f3a

VBScript
MD5: 96ae8c7e95898f16c8ba3ffc8c5c2f3a
Size: 2.65 MB
text/vbscript

This sample is a 2.5 MB VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 33 embedded or derived files. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
2364f559c5bdb5d3be97276c27ffa97d867549921217d3feaa0b87e922328db1
MD5
96ae8c7e95898f16c8ba3ffc8c5c2f3a
Verdict
Inconclusive
File type
VBScript · 2.5 MB

Cite this report: https://app.malva.re/sha256/2364f559c5bdb5d3be97276c27ffa97d867549921217d3feaa0b87e922328db1

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
2.65 MB · 2,648,697 B
First seen
2026-10-27 12:30 · 4 days ago
Last seen
2026-10-27 12:30 · 4 days ago
Last analysis
2026-10-27 12:30 · 4 days ago
Hashes
MD5 96ae8c7e95898f16c8ba3ffc8c5c2f3a Sha1 40c5a1d90ff9eb398931d75e1791c97b4fd9027f Sha256 2364f559c5bdb5d3be97276c27ffa97d867549921217d3feaa0b87e922328db1 Sha384 161644734a30a21ef2b4c921cee4e0d68abc726e539920c370c774952e64ec508021f22a68f51e699c032fda2224593b Sha512 10372e2af385068aee5285956e485ecadd71eab11b6218b2ea51e2724f3e3fe071d60802656485c6ef2098b291f69312ee593c50644b9bd0a3de67b468c21c2e SSDeep 49152:puI2h82+ji6I21C1NgaY2FRCdgbInX/SxVN7VCO:p5OojJmNTzPC+InX+N0O TLSH 1BC5E13FB28B653EE06E1A367A76E210583B7A61A5138C5697F4C88CCF250711D3F786
Detection
PeID
Borland Delphi 7 - Nstd EP - ASL sign Microsoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12

33 files
VBS96ae8c7e95898f16c8ba3ffc8c5c2f3a
Structure
VBSOverlay_162f32ad.bin
BINResources
BINRT_ICON
BINID:0064
IMGID:1033
IMGID:1033-preview.png
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINID:0067
IMGID:1033
IMGID:1033-preview.png
BINID:0068
IMGID:1033
IMGID:1033-preview.png
BINID:0069
IMGID:1033
IMGID:1033-preview.png
BINID:006A
IMGID:1033
IMGID:1033-preview.png
BINRT_STRING
BINID:0FF5
BINID:0
BINID:0FF6
BINID:0
BINID:0FF7
BINID:0
BINID:0FF8
BINID:0
BINID:0FF9
BINID:0
BINID:0FFA
BINID:0
BINID:0FFB
BINID:0
BINID:0FFC
BINID:0
BINID:0FFD
BINID:0
BINID:0FFE
BINID:0
BINID:0FFF
BINID:0
BINID:1000
BINID:0
BINRT_RCDATA
BINID:0000
BINID:0
BINID:2B67
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 1secondary ignored: 2
bin 1img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>scr:vbs
Shape pe:exe>scr:vbs
2 nodes

Name Value
Info
Overlay extracted: Overlay_162f32ad.bin (1794169 bytes)

33 files
VBS96ae8c7e95898f16c8ba3ffc8c5c2f3a
Structure
VBSOverlay_162f32ad.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙