Malicious
VBScript
MD5: 97add08f1d5f455c9622da5b5cbefdd7
Size: 1.42 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
1.42 MB · 1,415,042 B
First seen
2026-08-22 11:15 · 2 months ago
Last seen
2026-08-22 11:15 · 2 months ago
Last analysis
2026-09-03 18:08 · one month ago
Hashes
MD5
97add08f1d5f455c9622da5b5cbefdd7
Sha1
dde56ba294d7dbc30173c3feae910e7dc57ed6e5
Sha256
4adf23fc27cef167473728d1e89349f82f88630fe62a01f017834834d8f02e67
Sha384
5ed792ce8c4ff9e6029f36de68b03c20cbfbf6470c9fcc0e61054f2f0f5fff2e77bb247c918869d7a0dd3b6804e1fc89
Sha512
cc2e706d1ea19bd9377cedabb7419d8a950c1a97f57eebf313d5629e5a27b3eb5b7b1ca9873cced99e6a96ab355435cd6e7d97a3869fd7a83bef0b74f94b0dcb
SSDeep
24576:nw2M1E74v16mJukcL3xLXs1IjoH7rkMKFO7gM8Vvn8wCxnOw:nZM1h6mPbDXkZNNCEw
TLSH
F16512E0EF222CB273553297E1D19A0C96BD578A24CDDE9D9FF07162018A743C453BAB
4 malicious · 5 files
VBS97add08f1d5f455c9622da5b5cbefdd7T1027 · T1059 · T1059.001
BIN97add08f1d5f455c9622da5b5cbefdd7.deobfuscated.vbs
BIN97add08f1d5f455c9622da5b5cbefdd7.comtrace
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1059~T1059.005>scr:bat
Shape
scr:vbs>scr:bat
technique2 nodes
Command (COM trace) #1
UNKNWOWNmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #2
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$JEND huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential