Malicious
VBScript
MD5: 9734e9cd44c3e99341c97b49bcf86189
Size: 908.91 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
908.91 KB · 908,911 B
First seen
2026-08-05 08:30 · 2 months ago
Last seen
2026-08-05 08:30 · 2 months ago
Last analysis
2026-08-05 21:30 · 2 months ago
Hashes
MD5
9734e9cd44c3e99341c97b49bcf86189
Sha1
3097624ee15a8034cb961155286207ec22e9299b
Sha256
98ae3f60a6f753207f4880cf211c155677c2b1725e0911d0eca3ccea97a199bd
Sha384
83bbce462c1adc833d6deeea2c41157b5d28dfdfc483533805c52b0c5e7e6c4e90feaade13be1ee9cc3be972ef8ccc6b
Sha512
a006c711ee6ab9b0699f0cdd81240d1410b89c4e7bf657400de17ed3662a60b810b90da204eba0e58c5774b746f3e891046d7fce918afa05a882681bf20ec2d3
SSDeep
768:S63BkWSDawU4SpWDaBMFpZVa2IQMd/jrCzONxvNa2BcwvdNpRJgPqy6w75AWcYH5:zAf0NRO
TLSH
471595874109EDE1C213FC75F681A6C6AE9601079E6BACE37D171AD8A032F7248DDE19
7 malicious · 8 files
VBS9734e9cd44c3e99341c97b49bcf86189T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN9734e9cd44c3e99341c97b49bcf86189.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1059.005>scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1059.005
Shape
scr:vbs>scr:ps1>scr:vbs
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential