Malicious
VBScript
MD5: b9db8ddd496f785ef1cdeebc35b5bbd4
Size: 192.55 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 188 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 7bcdc594eb3d76d271007ac5fcc2603f03e65553b533a7c0a5d1ab89c8a6d247
- MD5
- b9db8ddd496f785ef1cdeebc35b5bbd4
- Verdict
- Malicious
- File type
- VBScript · 188 KB
Cite this report: https://app.malva.re/sha256/7bcdc594eb3d76d271007ac5fcc2603f03e65553b533a7c0a5d1ab89c8a6d247
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
192.55 KB · 192,552 B
First seen
2026-11-02 21:00 · 6 hours ago
Last seen
2026-11-02 21:00 · 6 hours ago
Last analysis
2026-11-02 21:00 · 6 hours ago
Hashes
MD5
b9db8ddd496f785ef1cdeebc35b5bbd4
Sha1
d288644d204f5f806fbfa1c6429ef6bf7ff4cf54
Sha256
7bcdc594eb3d76d271007ac5fcc2603f03e65553b533a7c0a5d1ab89c8a6d247
Sha384
1e77bbe42159eaf5405152940c1b52ee8bc86b27656d725201c3f8b47835fa5297dea3647642f2bbf15954c89a29fd84
Sha512
5eaba491a29105258407bf447d8a66ee4cb0f307edd11dcfb700084d1c2316a9e89999a1ebc7e155ff062166262387429e52a9b4dd880a929737cf592c2771cf
SSDeep
3072:sJu8xhU80/pFWcWjQqRKAElgXNpvKxg0l39Q4j7vJ4lfUZcitdVMNvGKAuGBSov+:sJXu8apOlKAE2XNJKxg0l39QCvilfUtW
TLSH
1014F1CA5DCC3C17E9AD191F3CFDC22147531CB2BB5874926C7862A41B280D6E7B1AE2
Detection
Symbol obfuscation
Low
3 malicious · 3 files
VBSb9db8ddd496f785ef1cdeebc35b5bbd4T1027 · T1059.005
VBSb9db8ddd496f785ef1cdeebc35b5bbd4.deobfuscated.vbsT1059.005
BIN.executed
VBS.subscript.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.005
Shape
scr:vbs
malicious
1 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential