Suspicious
Suspect

976f7e3cfb0e294e91d254e80ee921bf

VBScript
MD5: 976f7e3cfb0e294e91d254e80ee921bf
Size: 13.09 MB
text/vbscript

This sample is a 12.5 MB VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 14 embedded or derived files. It matches 7 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
65bb68bc934757abeece91a377d528e4fb1960e9da5f781ee5776b2f6be18c25
MD5
976f7e3cfb0e294e91d254e80ee921bf
Verdict
Inconclusive
File type
VBScript · 12.5 MB

Cite this report: https://app.malva.re/sha256/65bb68bc934757abeece91a377d528e4fb1960e9da5f781ee5776b2f6be18c25

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
13.09 MB · 13,094,720 B
First seen
2026-10-15 23:30 · 11 days ago
Last seen
2026-10-15 23:30 · 11 days ago
Last analysis
2026-10-15 23:30 · 11 days ago
Hashes
MD5 976f7e3cfb0e294e91d254e80ee921bf Sha1 67c2b22f7322ddd72d0b7c97f830a25b5ad51576 Sha256 65bb68bc934757abeece91a377d528e4fb1960e9da5f781ee5776b2f6be18c25 Sha384 0601400ff2e123a6defc8d1db3480e0cde7c3b1f903417ed2592077aff3551d70e5982f362c3e4d115b5ccd5112b55e7 Sha512 154205a6a0ff5b7d12d9426f9c24ed0d8913fa75568672cfbd1c6c9b5d1bf15c2fc85b4ffec791e2b16d90c5fe3be8bb00f3bc73ec4ca43e71eea56b46b621d9 SSDeep 98304:vqPmFvC//fYJSxz2cOrx0zn5D7ZKkZigkEGY:Bdq/I6WKn5ZNi+L TLSH 57D65A13ECA554E8C1AED130CAA691627B31BC495F3063DB1A70F6242FB3BD4ADB9354

15 files
VBS976f7e3cfb0e294e91d254e80ee921bf
Structure
P7B[Authenticode]_6989268a.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:0003
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:1033
B64[Base64-Block@0xFFFFFFFF]
IMG[Base64-Block-Decoded]
IMG[Base64-Block-Decoded]-preview.png
HTM0x004232A9.svg
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 2secondary ignored: 2
bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>enc:b64
Shape pe:exe>enc:b64
2 nodes
Path pe:exe>html
Shape pe:exe>html
2 nodes

Name Value
Info
Authenticode present at 0xC7AA00 size 9536 bytes

15 files
VBS976f7e3cfb0e294e91d254e80ee921bf
Structure
P7B[Authenticode]_6989268a.p7b
HTM0x004232A9.svg
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙