Suspicious
Suspect

b45609ef7c74d58140bd864c13a16363

VBScript
MD5: b45609ef7c74d58140bd864c13a16363
Size: 8.23 MB
text/vbscript

This sample is a 7.9 MB VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 107 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
44c55dd508b04f3e9a1efbd64b577f4dc0baa07ca3a090e6e227d3dcb724aa36
MD5
b45609ef7c74d58140bd864c13a16363
Verdict
Inconclusive
File type
VBScript · 7.9 MB
MITRE ATT&CK
T1059.007

Cite this report: https://app.malva.re/sha256/44c55dd508b04f3e9a1efbd64b577f4dc0baa07ca3a090e6e227d3dcb724aa36

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
8.23 MB · 8,232,448 B
First seen
2026-10-26 19:15 · 2 days ago
Last seen
2026-10-26 19:15 · 2 days ago
Last analysis
2026-10-26 19:15 · 2 days ago
Hashes
MD5 b45609ef7c74d58140bd864c13a16363 Sha1 4d1587508f9d372e47b48017de4d43d8647204ad Sha256 44c55dd508b04f3e9a1efbd64b577f4dc0baa07ca3a090e6e227d3dcb724aa36 Sha384 2299d1a0667a0e3a7633aadbb0475d29fdfc4ad7d605b57659ca8a0a2504f71c94eed58726618197d17fd82a490155de Sha512 a0863de5019920a4cb4c0592cd5be75f061d271100a856d6e51475ad9c14122899f5b04fbf53ecf75dabb97526c469fc05179967d0a48b0fe4e8b0be5404f1b8 SSDeep 49152:UZCKitd+vszAlozTy4g5z8+5eNBAkG8iAd4AHFphN/dBENJZvMdAem:4ihTy/OG8F4+FphN/d+lUd TLSH B986DF21B383C136D56D0177E968FE5E1938BE730B3102E777E8396E59B48C1A279B42

108 files
VBSb45609ef7c74d58140bd864c13a16363
EXEFC9978
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINID:0007
BINID:0
BINID:0008
IMGID:0
IMGID:0-preview.png
BINID:0009
IMGID:0
IMGID:0-preview.png
BINID:000A
IMGID:0
IMGID:0-preview.png
BINID:000B
IMGID:0
IMGID:0-preview.png
BINID:000C
IMGID:0
IMGID:0-preview.png
BINID:000D
IMGID:0
IMGID:0-preview.png
BINID:000E
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:4F51
BINID:0
BINID:553C
BINID:0
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
BINRoot Entry
BIN䡀䌏䈯
BIN䡀㲞䈝䗻
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀䌍䏤䊲
BIN䡀䕎䒵䠵
BIN䌋䄱䜵㷾䚨
BIN䌋䄱䜵㾾䠳
BIN䌧䎶䞁䄦䠥
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䋌䆨㫮䛲
BIN䡀䒌䗱䒵䠯
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䌋䄱䜵䌾䉱䠲
BIN䡀䆊䌷䑲䈝䗻
BIN䡀䈝䗻䗜䏼䠨
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䌋䄱䜵䗾䅤䄥䎦
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䄛䌧㫲䗸䒷䠱
BIN䡀䒌䗱䒵㮯䈹䗱
BIN䡀䕌䄨䈷䒏䇯䕨
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䙎䑨㶷䓤䌳䊱
BIN䌋䄱䜵䆾䐲䏳䗨䠬
BIN䌋䄱䜵䆾䖸䌷䒦䠱
BIN䌋䄱䜵䈾䆻䄯䌰䠦
BIN䌋䄱䜵䌾䖱䌷䒦䠱
BIN䌋䄱䜵䕾䐨䙲䆬䠲
BIN䌋䄱䜵䕾䓨䌤䌵䠦
IMG䌋䄱䜵䅾䑤䈱䞵䓭䠪
IMG䌋䄱䜵䅾䑤䈱䞵䓭䠪-preview.png
IMG䌋䄱䜵䅾䑤䈱䞵䙶䠪
IMG䌋䄱䜵䇾䄬䒯䞪䓭䠪
IMG䌋䄱䜵䇾䄬䒯䞪䓭䠪-preview.png
IMG䌋䄱䜵䇾䄬䒯䞪䙶䠪
EXE䌋䄱䜵䙾䈬䈺䞵䛨䠨
Structure
P7B[Authenticode]_5d3ec6a0.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲
JS䌋䄱䜵䄾䆬䖸䄷䗦䇾䏯
Structure
P7B[Authenticode]_aacafa83.p7b
BINResources
BINREGISTRY
BINID:27DA
BINID:1033
BINRT_DIALOG
BINID:2AB7
BINID:1033
BINRT_STRING
BINID:09C5
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
BIN䌋䄱䜵䆾䇰䌯䎱䕤䒵䠺
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BIN䡀䒋䗲䗶䄵䓳䕨㲞䈜䘴䑨䈦
IMG䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㠅䍾䊳
IMG䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㠅䍾䊳-preview.png
IMG䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㥂䍾䊳
IMG䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㥂䍾䊳-preview.png
IMG䌋䄱䜵䅾䑤䈱䞵䆶䏤㢨㠀䍾䊳
IMG䌋䄱䜵䅾䑤䈱䞵䆶䏤㢨㠀䍾䊳-preview.png
IMG䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㠅䍾䊳
IMG䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㠅䍾䊳-preview.png
IMG䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㥂䍾䊳
IMG䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㥂䍾䊳-preview.png
IMG䌋䄱䜵䇾䄬䒯䞪䆶䏤㢨㠀䍾䊳
IMG䌋䄱䜵䇾䄬䒯䞪䆶䏤㢨㠀䍾䊳-preview.png
BINSummaryInformation
IMG0x00024019.svg
IMG0x00024019.svg-preview.jpg
IMG0x000BC182.svg
IMG0x000BC182.svg-preview.jpg
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 8 STICH kept: 2secondary ignored: 6
bin 4img 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>pe:dll~T1059.007>pe:rsrc>bin
Shape ole:doc>pe:dll>pe:rsrc>bin
technique4 nodes
Path ole:doc>pe:dll~T1059.007>bin
Shape ole:doc>pe:dll>bin
technique3 nodes

108 files
VBSb45609ef7c74d58140bd864c13a16363
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙