987262918d652cb5ee909ce7a3f48e26

VBScript

MD5: 987262918d652cb5ee909ce7a3f48e26

Size: 158.17 KB

text/vbscript

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score High

MD5	987262918d652cb5ee909ce7a3f48e26
Sha1	f8746668b6baa7b9389cbaaa25172450285863b7
Sha256	2adf323e3f0472d671cc8dfa35fe49f06783d6e74b0ce4bd2cd208a710cb0db3
Sha384	91c744d5bd3951a746fe9c0f13fd5061df37b488dddf3121a7b85e601c56c3f9a0afac63dc1d134af2afc8d043e9e8f0
Sha512	7b1912bee1a35f66c39cae250ef5c52b755722b895effd22fcd64461fd5eb5cade3d5b32360eb2c195e79f0d36afc53489487dc4c907c27f0078540cd6ab48c1
SSDeep	1536:5uxYi9wCTebx5ELbfof4OSce8Z2Gafihur7E6F5eVhNHTueqsHb+K7f2PWF1aVBj:5O8E
TLSH	0FF3411A0735836579E36E6CEC60C9097B43E38AB338850C74E997485BE74D194E2FAF

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105

Shape scr:vbs

malicious 1 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 4huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 4huhuhuhuhuhuhuhuhuhuhu

987262918d652cb5ee909ce7a3f48e26

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

987262918d652cb5ee909ce7a3f48e26

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.