Malicious
VBScript
MD5: e737b5740ab356fb46d8fe0d96033cb9
Size: 1.55 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
1.55 MB · 1,550,195 B
First seen
2026-07-21 06:31 · 3 months ago
Last seen
2026-07-21 06:31 · 3 months ago
Last analysis
2026-07-21 13:49 · 3 months ago
Hashes
MD5
e737b5740ab356fb46d8fe0d96033cb9
Sha1
07ab88c64a87f3db9d8a0fc9f57af0179c743a62
Sha256
9ceeacd7f64359972fc44c73798a4e215effeff4bda4f6e309bedc67bc0c8d38
Sha384
ce86db93a83d9975fc960846ce86a5e086c1e43454c3d832307cea8cec6b7d759d628d51739ad8bce56f3b69a2b2e83a
Sha512
02a5d6079985c3f2cd3f1b0a30f8a874f5f1528bebfedd50d0ecd68cdefb5f1a1d788322ca435cb92b56b029c0c1dd0661ee6f3cab06dcb0b76c7a8d237331bc
SSDeep
24576:JRSfrAEH9XIYpj0BEHB5jZDidXPGfjuIb1iN1Eob4b:JgTbH94YxVv9z21K
TLSH
FA755A55A6A441A8E0A29578CB5EC933E7727CC60F70968F03D47DA73F33250BA297D2
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
6 malicious · 93 files
VBSe737b5740ab356fb46d8fe0d96033cb9T1027 · T1059.001 · T1059.005
Structure
VBSOverlay_b563d984.binT1027 · T1059.001 · T1059.005
RARsfx.rar
EXEUnRAR.exe
VBSinstall.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BINinstall.vbs.deobfuscated.vbs
SH[Command #0]
PS1run.ps1T1059.001
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 8
STICH kept: 4secondary ignored: 4
bin
3img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
pe:exe>scr:vbs>scr:vbs~T1059.005>scr:bat
Shape
pe:exe>scr:vbs>scr:vbs>scr:bat
malicious
4 nodes
Path
pe:exe>scr:vbs>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001
Shape
pe:exe>scr:vbs>scr:vbs>scr:ps1
malicious
4 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_b563d984.bin (806771 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |
Deobfuscated PowerShell
UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential