Malicious
VBScript
MD5: d0cec1850a2d55308369f58291d1f362
Size: 61.44 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
61.44 KB · 61,440 B
First seen
2026-07-19 09:00 · 3 months ago
Last seen
2026-07-19 09:00 · 3 months ago
Last analysis
2026-07-19 09:00 · 3 months ago
Hashes
MD5
d0cec1850a2d55308369f58291d1f362
Sha1
7ba2ce48b3f4c2d9745f74e6ac60208d92f0332b
Sha256
b1287ab346d488cf587ff52932119e02113403b9b9a7231e5c95fa0143de1a39
Sha384
f050a646d9520641ddd99c47a39465fb9337469df4c57a53984822862b1590f1f351d5dda315cbeb78c076ce60367b27
Sha512
89d0e82d27552c50730d9a4a3d73f8a850f7b0f158ca3bc36b5875adcba2da10f849af14bc731d182eaf40438c74954945998d7dd23cc7d40a6aad376d9fc540
SSDeep
1536:xHNGxoDRx3280h8ZAOc5ROeqNKHASY80h:pgROdKHAS
TLSH
C753313AD630FCD0C75D327086662D9A21986D56C7B34D64DB093DFE3D32B81EB29688
12 malicious · 31 files
VBSd0cec1850a2d55308369f58291d1f362T1027 · T1059.001 · T1059.005
BINRoot Entry
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
VBS䡀㼿䕷䑬㭪䗤䠤T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Base64-Block]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
VBSd0cec1850a2d55308369f58291d1f362.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc~T1027~T1059.005>scr:vbs>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:vbs>scr:ps1
malicious
3 nodes
Path
ole:doc~T1027~T1059.005>bin
Shape
ole:doc>bin
technique2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
-once huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential