Ctrl + scroll to zoom · drag to pan

This sample is a 10.7 MB VBScript classified as malicious by Malva.RE. Static analysis extracted 75 embedded or derived files. It matches 31 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
736a1327ed5c3f2a17999a47f90083fdb795a4df8a584eb112e4125cf8e9f49a
MD5
e024126a82f7d1201e2ec3c2b6d68245
Verdict
Malicious
File type
VBScript · 10.7 MB
MITRE ATT&CK
T1027T1059.007

Cite this report: https://app.malva.re/sha256/736a1327ed5c3f2a17999a47f90083fdb795a4df8a584eb112e4125cf8e9f49a

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
11.26 MB · 11,260,498 B
First seen
2026-11-03 16:00 · an hour ago
Last seen
2026-11-03 16:00 · an hour ago
Last analysis
2026-11-03 16:00 · an hour ago
Hashes
MD5 e024126a82f7d1201e2ec3c2b6d68245 Sha1 49828ee3cda0f31e067d49017fad4a546ff36199 Sha256 736a1327ed5c3f2a17999a47f90083fdb795a4df8a584eb112e4125cf8e9f49a Sha384 f04cf9ea1a439b600a9b833f292acde2d6c3a3bd560cd4b71fbab257bb12b217d4a8128c86443ebba1406f3a022ce334 Sha512 7828e589c592e92c3bdb4d352a834b4c5f7402785eb53c463f8b8e1dddff25183729341d31d319869e183880a281d683e86d7e9e4e02237b41353e2936cd0028 SSDeep 196608:S3aW/wW/Rn2cUUjqy7gLxCg6XwQx7Rn2cUejIyBgh:hkn2Ixn2v TLSH ACB68D1177D88035F5BF23B189BB976A927ABCA11B7186CF62C4091E1E316C25F35B23

3 malicious · 76 files
VBSe024126a82f7d1201e2ec3c2b6d68245
EXEUninstallerUI.exe
P7B[Authenticode]_197e318f.p7b
DLLhk64tbHot0.dll
Structure
P7B[Authenticode]_d1b9e955.p7b
DLLhktbHot0.dll
Structure
P7B[Authenticode]_4cb37eac.p7b
BINResources
BINBINARY
BINID:02F7
IMGID:1033
IMGID:1033-preview.png
BINID:02F8
IMGID:1033
IMGID:1033-preview.png
BINID:02F9
IMGID:1033
IMGID:1033-preview.png
BINID:02FA
IMGID:1033
IMGID:1033-preview.png
BINID:02FB
IMGID:1033
IMGID:1033-preview.png
BINID:02FC
IMGID:1033
IMGID:1033-preview.png
BINID:02FD
IMGID:1033
IMGID:1033-preview.png
BINID:02FE
IMGID:1033
IMGID:1033-preview.png
BINID:02FF
IMGID:1033
IMGID:1033-preview.png
BINID:0300
IMGID:1033
IMGID:1033-preview.png
BINID:0301
IMGID:1033
IMGID:1033-preview.png
BINID:0302
IMGID:1033
IMGID:1033-preview.png
BINID:0303
IMGID:1033
IMGID:1033-preview.png
BINID:0304
IMGID:1033
IMGID:1033-preview.png
BINID:0305
IMGID:1033
IMGID:1033-preview.png
BINID:0306
IMGID:1033
IMGID:1033-preview.png
BINID:0307
IMGID:1033
IMGID:1033-preview.png
BINID:0308
IMGID:1033
IMGID:1033-preview.png
BINID:0309
IMGID:1033
IMGID:1033-preview.png
BINID:030A
IMGID:1033
IMGID:1033-preview.png
BINID:0311
IMGID:1033
IMGID:1033-preview.png
BINID:0312
IMGID:1033
IMGID:1033-preview.png
BINID:0313
IMGID:1033
IMGID:1033-preview.png
BINID:0314
IMGID:1033
IMGID:1033-preview.png
BINID:0315
IMGID:1033
IMGID:1033-preview.png
BINID:0316
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0065
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
DLLhktbHots.dll
Structure
P7B[Authenticode]_eeb86085.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLldrtbHots.dll
Structure
P7B[Authenticode]_439f815e.p7b
DLLprxtbHot0.dll
Structure
P7B[Authenticode]_b8ec3680.p7b
HTMUninstallerUI (1).exe
P7B[Authenticode]_02a7d14e.p7b
BIN9903392a451e5063e098e4a6ff025fb7cd3da3d0
JSdata_2 (47)
BINdata_2 (47).emulated
JS[Stage #1].js
EXEexplore.exe
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 1secondary ignored: 6
bin 5img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs>scr:js~T1027~T1059.007
Shape scr:vbs>scr:js
malicious 2 nodes

Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? evhuhuhuhuhuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 76 files
VBSe024126a82f7d1201e2ec3c2b6d68245
BIN9903392a451e5063e098e4a6ff025fb7cd3da3d0
JSdata_2 (47)
BINdata_2 (47).emulated
JS[Stage #1].js
No malware configuration was found at this point.

Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? evhuhuhuhuhuhuhuhuhuhuhu
e024126a82f7d1201e2ec3c2b6d68245 › data_2 (47)
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
e024126a82f7d1201e2ec3c2b6d68245 › UninstallerUI.exe
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙