Deep Malware Analysis of bd623574204d3ee8c509c6a014e04907 | md5: bd623574204d3ee8c509c6a014e04907 | PowerShell | Batch Command | PowerShell Call | SMTPControl.SMTP | Scripting.FileSystemObject | VBScript | DeObfuscated

Malicious

bd623574204d3ee8c509c6a014e04907.deobfuscated.vbs

Malicious

[Command #0]

Powershell: Hidden Execution

Batch Command

PowerShell Call

Malicious

[PowerShell Command]

Malicious

[Deobfuscated PS]

Malicious

[Base64-Block]

Malicious

[Deobfuscated PS]

Malicious

[Base64-Block]

[Deobfuscated PS]

Malicious

[PowerShell Command]

Scripting.FileSystemObject

Malicious

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Invokhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$null huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Invokhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$null huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Invokhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

bd623574204d3ee8c509c6a014e04907

VBScript

Malicious

bd623574204d3ee8c509c6a014e04907.deobfuscated.vbs

Malicious

[Command #0]

Powershell: Hidden Execution

Batch Command

PowerShell Call

Malicious

[PowerShell Command]

Malicious

[Deobfuscated PS]

Malicious

[Base64-Block]

Malicious

[Deobfuscated PS]

Malicious

[Base64-Block]

[Deobfuscated PS]

Malicious

[PowerShell Command]