Malicious
VBScript
MD5: c2448645643594cb7f18fba2f446bf1b
Size: 689.85 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 673.7 KB VBScript classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d
- MD5
- c2448645643594cb7f18fba2f446bf1b
- Verdict
- Malicious
- File type
- VBScript · 673.7 KB
Cite this report: https://app.malva.re/sha256/5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
689.85 KB · 689,849 B
Hashes
MD5
c2448645643594cb7f18fba2f446bf1b
Sha1
ef2a76e417611c9b484a2a31b2ed109137f6a56e
Sha256
5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d
Sha384
e3d18f8bbe9cb10d03fc63c63e5567ca38b3053832d33e739fdd637124b219ba4bad85419f7dd4722303a567875f4c1e
Sha512
ad7fe4a9665ab1be6681f22973ee9deda1d22bbd12d0622ee63ddc86734e58593680dc7be4e03d1bb671ca155a01e8aacfa25d6ea7b8c847bd66c20eb4d0baee
SSDeep
12288:klywRE9nQygooaB1X61DbWwXwm12B7prdfLWrMk0vcuhpTgRIOm/pQyQ1CFF8z:Cgl61DSwXw/RpfFpTv3/plUfz
TLSH
2AE423D5A0C56528737F27613A93982187F741B7B664B4683E5CB2DC0B3A30D4B8E0BB
Detection
Symbol obfuscation
Low
3 malicious · 3 files
VBSc2448645643594cb7f18fba2f446bf1bT1027 · T1059.005
VBSc2448645643594cb7f18fba2f446bf1b.deobfuscated.vbsT1059.005
BIN.executed
VBS.subscript.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.005
Shape
scr:vbs
malicious
1 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential