Malicious
VBScript
MD5: e737b5740ab356fb46d8fe0d96033cb9
Size: 1.55 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | e737b5740ab356fb46d8fe0d96033cb9 |
| Sha1 | 07ab88c64a87f3db9d8a0fc9f57af0179c743a62 |
| Sha256 | 9ceeacd7f64359972fc44c73798a4e215effeff4bda4f6e309bedc67bc0c8d38 |
| Sha384 | ce86db93a83d9975fc960846ce86a5e086c1e43454c3d832307cea8cec6b7d759d628d51739ad8bce56f3b69a2b2e83a |
| Sha512 | 02a5d6079985c3f2cd3f1b0a30f8a874f5f1528bebfedd50d0ecd68cdefb5f1a1d788322ca435cb92b56b029c0c1dd0661ee6f3cab06dcb0b76c7a8d237331bc |
| SSDeep | 24576:JRSfrAEH9XIYpj0BEHB5jZDidXPGfjuIb1iN1Eob4b:JgTbH94YxVv9z21K |
| TLSH | FA755A55A6A441A8E0A29578CB5EC933E7727CC60F70968F03D47DA73F33250BA297D2 |
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
Malicious
Malicious
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 8
STICH kept: 4secondary ignored: 4
bin
3img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
pe:exe>scr:vbs>scr:vbs~T1059.005>scr:bat
Shape
pe:exe>scr:vbs>scr:vbs>scr:bat
malicious
4 nodes
Path
pe:exe>scr:vbs>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001
Shape
pe:exe>scr:vbs>scr:vbs>scr:ps1
malicious
4 nodes
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_b563d984.bin (806771 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |
Deobfuscated PowerShell
UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential