Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 1.1 MB VBScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 4 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
77a9f1e83822eff548e6e5590e62a4d1cea5f152b9a2d414dcbdb451b5053a62
MD5
c43ffe98a9eae49b941b11b58f84e695
Verdict
Malicious
File type
VBScript · 1.1 MB
MITRE ATT&CK
T1027T1059T1059.005

Cite this report: https://app.malva.re/sha256/77a9f1e83822eff548e6e5590e62a4d1cea5f152b9a2d414dcbdb451b5053a62

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
1.17 MB · 1,171,960 B
First seen
2026-10-27 06:45 · an hour ago
Last seen
2026-10-27 06:45 · an hour ago
Last analysis
2026-10-27 06:50 · an hour ago
Hashes
MD5 c43ffe98a9eae49b941b11b58f84e695 Sha1 e965adeac77e64ad55ee5e1375558734b62af1da Sha256 77a9f1e83822eff548e6e5590e62a4d1cea5f152b9a2d414dcbdb451b5053a62 Sha384 9f5586aaba06f712b93ca812d22614d4dc97cb7ad121489eb54ff8f8fa3ca23c9ece128578c6ed94e5bc5701d155cf25 Sha512 6ca3987bec3ebe645f4059e3e133761927460c033e507e5d6e2ceba16d2902d85ced2cdbd48fc7bbf814d0d7242825ba4921c9525976fb4b22ec838a11867358 SSDeep 24576:+Bvd4dp/Y67svEKoCSc0ZvqClkYTIp31XliMWr+JyNNqVn:+BvdmiCCb0ZWFO7qVn TLSH CA4501304D8E7EA5CABA4608D0FB130F4ED0BD4715776D89DE132D416B967C0E12FAAA
Detection
Symbol obfuscation
Low

2 malicious · 4 files
VBSc43ffe98a9eae49b941b11b58f84e695
EXE[Base64-Block @0x000403DB]
VBSc43ffe98a9eae49b941b11b58f84e695.deobfuscated.vbs
EXE[Base64-Block @0x000001D0]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1059~T1059.005>pe:exe
Shape scr:vbs>pe:exe
malicious 2 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

2 malicious · 4 files
VBSc43ffe98a9eae49b941b11b58f84e695
EXE[Base64-Block @0x000403DB]
VBSc43ffe98a9eae49b941b11b58f84e695.deobfuscated.vbs
EXE[Base64-Block @0x000001D0]
No malware configuration was found at this point.

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
c43ffe98a9eae49b941b11b58f84e695 › [Base64-Block @0x000403DB]
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
c43ffe98a9eae49b941b11b58f84e695
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙