Malicious
VBScript
MD5: b20aff73cdcda7ee29b0e3f28c85d796
Size: 67.25 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
67.25 KB · 67,248 B
First seen
2026-08-24 09:00 · 2 months ago
Last seen
2026-08-24 09:00 · 2 months ago
Last analysis
2026-09-03 18:08 · one month ago
Hashes
MD5
b20aff73cdcda7ee29b0e3f28c85d796
Sha1
ab9dc6cc0f78d677fea76f51b59b58edb6efee71
Sha256
2da298f74981ccb598542ebd7141e419ee1d3c5b3bbb7ee66657cba543c1d1e4
Sha384
0ad41a67e21f76e042af399a45fd17276bf198c9734492751085b076a2c360ec3515e0bb182be7df80b55ee515ec5b30
Sha512
ecb65020d32089bc205d09854bc0b271ad8578986b9c899fd018cf3ab716f561274e58a7237145fe4b440302eb25a9a3356cd7f970dac76bc4fb584e632353a8
SSDeep
768:MBD2RXab/eJBhSsFo3kTTl77sZAk76vqq5O2JtyTQ/ee9EkVBGJVDCCZyaBxsNZu:peyxkuJA2psU14n
TLSH
95639EA21E28C0E32D5DB45460C5DFEE867A7127ADB94E0717248BA2CFBD1C73E855C2
Detection
Symbol obfuscation
Low
10 malicious · 10 files
VBSb20aff73cdcda7ee29b0e3f28c85d796T1027 · T1059 · T1105
VBSb20aff73cdcda7ee29b0e3f28c85d796.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
BIN.executed
VBS.subscript.vbsT1027 · T1059 · T1105
VBS.subscript.vbs.deobfuscated.vbsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1059~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 9huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential