Malicious
Extractor.file_0.dat
VBScript Encoded
MD5: a0ffb31d84c2f5ffacd879f4f12c1ce6
Size: 1.44 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
1.44 MB · 1,436,809 B
First seen
2026-10-13 04:30 · 12 days ago
Last seen
2026-10-13 04:30 · 12 days ago
Last analysis
2026-10-13 04:30 · 12 days ago
Hashes
MD5
a0ffb31d84c2f5ffacd879f4f12c1ce6
Sha1
2280ee7e5d7dbf727306dd6b47025bd547172a57
Sha256
b028b2b4a6a39c51841a13e12f483b901339995a3ba40f46c63b4055d7a781a9
Sha384
23405ec166a846e9be4136725b78c24dd1ead39dd44e85dd24611a7c108610d8257477116ccc0718af55cb1636626681
Sha512
25d06639cf3bb8ca353f96bbd55d5ff5298a4022b86c57f1416932a8411d1bf49a1b65d267d0a67aaade5299e57f2982196780cace8b5e7a46a4b2833b300087
SSDeep
24576:U2G/nvxW3Ww0toautb3DPlC9XxQpH9hl9AwLcIlDQ20NBtCxC:UbA30o7t/9rhcwHp6Rr
TLSH
1F657B017E44CE11F0191633C2EF4A0447B4AC51AAA6E72B7EFA376E55223937D1DACB
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
5 malicious · 35 files
VBSa0ffb31d84c2f5ffacd879f4f12c1ce6T1027 · T1059 · T1059.005
Structure
VBSOverlay_5f7b4f34.bin
BATG3Qfs1kOHl20hun6eQCKvPdReFy.bat
EXEwinbroker.exe
Structure
BIN.Net Resources
BINh3T8KwP0aqNmPDh8Nn.xNDNpqFr0LTTGOPf8o
BINIIBSjebJsVToxD36qu.kFibJTmxPJlIEXY6o5
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
VBSe1zmNuk6PgHvGo3oCCD0Yo1C0Wi.vbe
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
VBSa0ffb31d84c2f5ffacd879f4f12c1ce6.decoded.vbsT1027 · T1059 · T1059.005
VBSa0ffb31d84c2f5ffacd879f4f12c1ce6.decoded.vbs.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
7 / 7
Path
pe:exe>scr:vbe>pe:exe>pe:rsrc>bin
Shape
pe:exe>scr:vbe>pe:exe>pe:rsrc>bin
malicious
5 nodes
Path
pe:exe>scr:vbe>pe:exe>bin
Shape
pe:exe>scr:vbe>pe:exe>bin
malicious
4 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_5f7b4f34.bin (1120393 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |
Command (COM trace) #1
UNKNWOWNmalicious
C:/Porhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential5 malicious · 35 files
VBSa0ffb31d84c2f5ffacd879f4f12c1ce6T1027 · T1059 · T1059.005
Structure
VBSOverlay_5f7b4f34.bin
BATG3Qfs1kOHl20hun6eQCKvPdReFy.bat
EXEwinbroker.exe
Structure
BIN.Net Resources
BINResources
VBSe1zmNuk6PgHvGo3oCCD0Yo1C0Wi.vbe
BINResources
VBSa0ffb31d84c2f5ffacd879f4f12c1ce6.decoded.vbsT1027 · T1059 · T1059.005
VBSa0ffb31d84c2f5ffacd879f4f12c1ce6.decoded.vbs.deobfuscated.vbsT1059.005
No malware configuration was found at this point.
Command (COM trace) #1
UNKNWOWNmalicious
C:/Porhuhuhuhuhuhuhuhuhuhuhu
a0ffb31d84c2f5ffacd879f4f12c1ce6 › a0ffb31d84c2f5ffacd879f4f12c1ce6.decoded.vbs
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0ffb31d84c2f5ffacd879f4f12c1ce6 › a0ffb31d84c2f5ffacd879f4f12c1ce6.decoded.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account