Malicious
b5ddc4596d02f40f5b78812844cf31c2
VBScript
MD5: b5ddc4596d02f40f5b78812844cf31c2
Size: 58.05 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 56.7 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- bebb74b215f820e8ee42d9ed10a7cfc1748aadde375ec8dec519a19ede745fb1
- MD5
- b5ddc4596d02f40f5b78812844cf31c2
- Verdict
- Malicious
- File type
- VBScript · 56.7 KB
Cite this report: https://app.malva.re/sha256/bebb74b215f820e8ee42d9ed10a7cfc1748aadde375ec8dec519a19ede745fb1
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
58.05 KB · 58,049 B
First seen
2026-11-02 13:45 · 6 hours ago
Last seen
2026-11-02 13:45 · 6 hours ago
Last analysis
2026-11-02 13:46 · 6 hours ago
Hashes
MD5
b5ddc4596d02f40f5b78812844cf31c2
Sha1
973de8bf374ccbf37dd4070a319819735136cf41
Sha256
bebb74b215f820e8ee42d9ed10a7cfc1748aadde375ec8dec519a19ede745fb1
Sha384
346561cf14bcd61f90ed2840787e2f22becc66d31355a342d95e600808364ea37a5ae28683fc8515fffff966024e76d8
Sha512
68f6eb530b9190b459e2a06f438dc757ab7b038bbeedce901b2e4f0f66f22e4e0fec61e645006e893b82a2dfc117a22cb553ee25abba5d5dbb007af082582a0a
SSDeep
768:cs8x4JgWwmPguWa143KNRSamuVx1wFr4E8zBxI1GWKshGYXqAKnE00yVl1ZPQ:csAghw1tymgi49HIIWfhGTnXVj6
TLSH
5843E43CEA2131250D7A32AA9B74496D84E94335311273BC6DF8A2591F86E48EF7CF47
Detection
Symbol obfuscation
Medium
5 malicious · 6 files
VBSb5ddc4596d02f40f5b78812844cf31c2T1027 · T1059.001 · T1059.005
VBSb5ddc4596d02f40f5b78812844cf31c2.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential5 malicious · 6 files
VBSb5ddc4596d02f40f5b78812844cf31c2T1027 · T1059.001 · T1059.005
VBSb5ddc4596d02f40f5b78812844cf31c2.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
b5ddc4596d02f40f5b78812844cf31c2
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account