Malicious
VBScript
MD5: c43ffe98a9eae49b941b11b58f84e695
Size: 1.17 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
This sample is a 1.1 MB VBScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 4 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 77a9f1e83822eff548e6e5590e62a4d1cea5f152b9a2d414dcbdb451b5053a62
- MD5
- c43ffe98a9eae49b941b11b58f84e695
- Verdict
- Malicious
- File type
- VBScript · 1.1 MB
Cite this report: https://app.malva.re/sha256/77a9f1e83822eff548e6e5590e62a4d1cea5f152b9a2d414dcbdb451b5053a62
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
1.17 MB · 1,171,960 B
First seen
2026-10-27 06:45 · an hour ago
Last seen
2026-10-27 06:45 · an hour ago
Last analysis
2026-10-27 06:50 · an hour ago
Hashes
MD5
c43ffe98a9eae49b941b11b58f84e695
Sha1
e965adeac77e64ad55ee5e1375558734b62af1da
Sha256
77a9f1e83822eff548e6e5590e62a4d1cea5f152b9a2d414dcbdb451b5053a62
Sha384
9f5586aaba06f712b93ca812d22614d4dc97cb7ad121489eb54ff8f8fa3ca23c9ece128578c6ed94e5bc5701d155cf25
Sha512
6ca3987bec3ebe645f4059e3e133761927460c033e507e5d6e2ceba16d2902d85ced2cdbd48fc7bbf814d0d7242825ba4921c9525976fb4b22ec838a11867358
SSDeep
24576:+Bvd4dp/Y67svEKoCSc0ZvqClkYTIp31XliMWr+JyNNqVn:+BvdmiCCb0ZWFO7qVn
TLSH
CA4501304D8E7EA5CABA4608D0FB130F4ED0BD4715776D89DE132D416B967C0E12FAAA
Detection
Symbol obfuscation
Low
2 malicious · 4 files
VBSc43ffe98a9eae49b941b11b58f84e695T1027 · T1059 · T1059.005
EXE[Base64-Block @0x000403DB]
VBSc43ffe98a9eae49b941b11b58f84e695.deobfuscated.vbsT1059.005
EXE[Base64-Block @0x000001D0]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005>pe:exe
Shape
scr:vbs>pe:exe
malicious
2 nodes
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential