Malicious
b59e29d037c6a24ef862304efe95b25c
VBScript
MD5: b59e29d037c6a24ef862304efe95b25c
Size: 1.19 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
1.19 MB · 1,194,393 B
First seen
2026-07-16 07:31 · 3 months ago
Last seen
2026-07-16 07:31 · 3 months ago
Last analysis
2026-07-18 18:56 · 3 months ago
Hashes
MD5
b59e29d037c6a24ef862304efe95b25c
Sha1
14c890513b9f2eabde1e18ffaa9e0cc098745f40
Sha256
565f971ad49449edb483a26a837a1d88d50ea4f43520c4705abb2051116a077b
Sha384
092ae309bb9edd0bbd9fcf2cbbb8bb755caec9b43b6ff8749e8c7a01422202701019ec706c62ef0070a4219da3176be2
Sha512
c5cee579a5179ac1074df89e14349a57cab3c83c4f9beadbd98666b5acfe7c4144884e0a8028b0ea8ff8e70778c2df3f06bef5fb96443226a8934d2420e46d8d
SSDeep
384:i+B8WJPIWdrxONWJJcn2/0Cgh/0jrjWsoNMOUM49tEf:i+BIUcC22/U/LsAR49tc
TLSH
FF4543C6BA1B1049FDF4A272652F4C970CACBCCA613854B16F03A19721CA8DD7951BBF
11 malicious · 12 files
VBSb59e29d037c6a24ef862304efe95b25cT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BINb59e29d037c6a24ef862304efe95b25c.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
SH[Command #1] T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
scr:vbs~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential11 malicious · 12 files
VBSb59e29d037c6a24ef862304efe95b25cT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BINb59e29d037c6a24ef862304efe95b25c.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
SH[Command #1] T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
b59e29d037c6a24ef862304efe95b25c › b59e29d037c6a24ef862304efe95b25c.deobfuscated.vbs › [Command #1]
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
b59e29d037c6a24ef862304efe95b25c › b59e29d037c6a24ef862304efe95b25c.deobfuscated.vbs › [Command #1] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
b59e29d037c6a24ef862304efe95b25c › b59e29d037c6a24ef862304efe95b25c.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account