Malicious
e737b5740ab356fb46d8fe0d96033cb9
VBScript
MD5: e737b5740ab356fb46d8fe0d96033cb9
Size: 1.55 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
1.55 MB · 1,550,195 B
First seen
2026-07-21 06:31 · 3 months ago
Last seen
2026-07-21 06:31 · 3 months ago
Last analysis
2026-07-21 13:49 · 3 months ago
Hashes
MD5
e737b5740ab356fb46d8fe0d96033cb9
Sha1
07ab88c64a87f3db9d8a0fc9f57af0179c743a62
Sha256
9ceeacd7f64359972fc44c73798a4e215effeff4bda4f6e309bedc67bc0c8d38
Sha384
ce86db93a83d9975fc960846ce86a5e086c1e43454c3d832307cea8cec6b7d759d628d51739ad8bce56f3b69a2b2e83a
Sha512
02a5d6079985c3f2cd3f1b0a30f8a874f5f1528bebfedd50d0ecd68cdefb5f1a1d788322ca435cb92b56b029c0c1dd0661ee6f3cab06dcb0b76c7a8d237331bc
SSDeep
24576:JRSfrAEH9XIYpj0BEHB5jZDidXPGfjuIb1iN1Eob4b:JgTbH94YxVv9z21K
TLSH
FA755A55A6A441A8E0A29578CB5EC933E7727CC60F70968F03D47DA73F33250BA297D2
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
6 malicious · 93 files
VBSe737b5740ab356fb46d8fe0d96033cb9T1027 · T1059.001 · T1059.005
Structure
VBSOverlay_b563d984.binT1027 · T1059.001 · T1059.005
RARsfx.rar
EXEUnRAR.exe
Structure
P7B[Authenticode]_5a7224d2.p7b
BINResources
BINRT_STRING
BINID:01F5
BINID:1033
BINID:01F6
BINID:1033
BINID:01F7
BINID:1033
BINID:01F8
BINID:1033
BINID:01F9
BINID:1033
BINID:01FA
BINID:1033
BINID:01FB
BINID:1033
BINID:01FC
BINID:1033
BINID:01FD
BINID:1033
BINID:01FE
BINID:1033
BINID:01FF
BINID:1033
BINID:0200
BINID:1033
BINID:0201
BINID:1033
BINID:0202
BINID:1033
BINID:0203
BINID:1033
BINID:0204
BINID:1033
BINID:0205
BINID:1033
BINID:0206
BINID:1033
BINID:0207
BINID:1033
BINID:0208
BINID:1033
BINID:0209
BINID:1033
BINID:020A
BINID:1033
BINID:020B
BINID:1033
BINID:020C
BINID:1033
BINID:020D
BINID:1033
BINID:020E
BINID:1033
BINID:020F
BINID:1033
BINID:0210
BINID:1033
BINID:0211
BINID:1033
BINID:0212
BINID:1033
BINID:0213
BINID:1033
BINID:0214
BINID:1033
BINID:0215
BINID:1033
BINID:0216
BINID:1033
BINID:0217
BINID:1033
BINID:0218
BINID:1033
BINID:0219
BINID:1033
BINID:021A
BINID:1033
BINID:021B
BINID:1033
BINID:021C
BINID:1033
BINID:021D
BINID:1033
BINID:021E
BINID:1033
BINID:021F
BINID:1033
BINID:0220
BINID:1033
BINID:0221
BINID:1033
BINID:0222
BINID:1033
BINID:0223
BINID:1033
BINID:0224
BINID:1033
BINID:0225
BINID:1033
BINID:0226
BINID:1033
BINID:0227
BINID:1033
BINID:0228
BINID:1033
BINID:0229
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
VBSinstall.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BINinstall.vbs.deobfuscated.vbs
SH[Command #0]
PS1run.ps1T1059.001
BINResources
BINPNG
BINID:0065
IMGID:25
IMGID:25-preview.png
BINID:0066
IMGID:25
IMGID:25-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:25
BINRT_STRING
BINID:0007
BINID:25
BINID:0008
BINID:25
BINID:0009
BINID:25
BINID:000A
BINID:25
BINID:000B
BINID:25
BINID:000C
BINID:25
BINID:000D
BINID:25
BINID:000E
BINID:25
BINID:000F
BINID:25
BINID:0010
BINID:25
BINID:0011
BINID:25
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:25
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 8
STICH kept: 4secondary ignored: 4
bin
3img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
pe:exe>scr:vbs>scr:vbs~T1059.005>scr:bat
Shape
pe:exe>scr:vbs>scr:vbs>scr:bat
malicious
4 nodes
Path
pe:exe>scr:vbs>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001
Shape
pe:exe>scr:vbs>scr:vbs>scr:ps1
malicious
4 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_b563d984.bin (806771 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |
Deobfuscated PowerShell
UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 93 files
VBSe737b5740ab356fb46d8fe0d96033cb9T1027 · T1059.001 · T1059.005
Structure
VBSOverlay_b563d984.binT1027 · T1059.001 · T1059.005
RARsfx.rar
EXEUnRAR.exe
VBSinstall.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BINinstall.vbs.deobfuscated.vbs
SH[Command #0]
PS1run.ps1T1059.001
BINResources
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
e737b5740ab356fb46d8fe0d96033cb9 › Overlay_b563d984.bin › install.vbs › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account