Malicious
VBScript
MD5: c9c5b780c2162e732b0e69b9164b49cd
Size: 1.04 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
1.04 MB · 1,044,469 B
First seen
2026-07-20 09:16 · 3 months ago
Last seen
2026-07-20 09:16 · 3 months ago
Last analysis
2026-07-21 13:33 · 3 months ago
Hashes
MD5
c9c5b780c2162e732b0e69b9164b49cd
Sha1
6e986afe29bb02769f99225a4b6ccee7c685dc22
Sha256
3491d7703b8b7932df9e33bddc446c3037ecfd288557320d3f23934c78370094
Sha384
410e232c6fffdd67c4caa79781f79f55e8540be93c38221b8db76402016a8a98f08ae59dcc464a4c43e39f75b0079a4f
Sha512
edc2f539b1ef7202a3f75fb19ea771b163f928a5cc81369094fa6c6b3b8570641da8a48166f76910d93b71318ee8d234653af402fe0c950aa89e48d1aa4152cf
SSDeep
192:Yeq4oBdW2Vx1rD6cpBvXH1HcyRuStwfGEtNz+CG2/I0pE8:p+1rD7PXH1HcyRXtwfbrzvM2
TLSH
712555F53B4D048AE7D69822EC6AE90A5DEC2CF55DAD12C22BCFD0CA9035191FE746C1
11 malicious · 12 files
VBSc9c5b780c2162e732b0e69b9164b49cdT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BINc9c5b780c2162e732b0e69b9164b49cd.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
SH[Command #1] T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
scr:vbs~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential