Malicious
a2933db171f863abe40e96ecb3caf997
VBScript
MD5: a2933db171f863abe40e96ecb3caf997
Size: 150 B
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
150 B · 150 B
First seen
2026-07-14 12:31 · 3 months ago
Last seen
2026-07-14 12:31 · 3 months ago
Last analysis
2026-07-14 12:31 · 3 months ago
Hashes
MD5
a2933db171f863abe40e96ecb3caf997
Sha1
cae28229285d02c86136a5e5bcb6c726071fe932
Sha256
cca1348574adbec17ae552954b595da6190ea15c2e1bb6b52f5592f82c196781
Sha384
1cf57dc58ec31aded24d5fbdda880006e13ec110aefd1203a05101c408ef83ec69310f51ee74f2348e26ea5704b2ba35
Sha512
dbc47f76b85b08b54f3a24dc7789129ab7ba4746476321aecdff9cd8ab2ad785a58c187deb67ac6a63083734ce1c9a2f19c28ed19cb6bbbf8ea77d4c8b11e8ba
SSDeep
3:jeYcRm8nhr2SSJJFItGQqPJH0cVERvMXI3eEOD4o6cxpv:jeUqhrK80QO0ceuEs4oJL
6 malicious · 6 files
VBSa2933db171f863abe40e96ecb3caf997T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BINa2933db171f863abe40e96ecb3caf997.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:ps1
malicious
2 nodes
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
irhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 6 files
VBSa2933db171f863abe40e96ecb3caf997T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BINa2933db171f863abe40e96ecb3caf997.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
a2933db171f863abe40e96ecb3caf997
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokhuhuhuhuhuhuhu
a2933db171f863abe40e96ecb3caf997 › a2933db171f863abe40e96ecb3caf997.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
irhuhuhuhuhuhuhuhuhuhuhu
a2933db171f863abe40e96ecb3caf997 › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account