Malicious
VBScript
MD5: da8e26b87e7ab3bbc11d9871cc400627
Size: 5.51 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
5.51 MB · 5,507,119 B
First seen
2026-07-28 14:46 · 3 months ago
Last seen
2026-07-28 14:46 · 3 months ago
Last analysis
2026-07-28 14:46 · 3 months ago
Hashes
MD5
da8e26b87e7ab3bbc11d9871cc400627
Sha1
eb39e030b6c13c2c8a28e88b75f489b6dc624604
Sha256
ed48e74129c7f946abf72f6a14d4683a69cad54787e91c8a0b84b41b5eedfbd5
Sha384
7d310d6619682b0f35ba9a5668d1a68dbf92224389392e3f3c63408b250941fa73b708e75be5f7d31a853379a760c2b4
Sha512
1fdb5277f5b17276386955eb358fec4761186b9afed91a225cbe6fbb13f3aa69259809f8e08c948a79069dcf7de4bde4226d31fec9014e66a2965959238cc595
SSDeep
24576:FqTdye/nXJYlqjDd+7A5zlQYRxHTkQ/QxrJk+jaDNlJBAR/cq65ZaL47HReAZxVc:k+D93X
TLSH
C7469F506E5859F5EF8C290E90AEAF1D87F042176A33706BFB41DF05BEDA241864B21F
23 malicious · 25 files
VBSda8e26b87e7ab3bbc11d9871cc400627T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
B64[Base64-Block@0x0000028C]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1059.001>enc:b64
Shape
scr:vbs>enc:b64
technique2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
_
""
huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
_
""
huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
" &
_huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
" &
_huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
" &
_huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential