Malicious
Malicious

e84bcb3a32a6dbd9c200a04ddd98e95c

Share on LinkedIn
Print
VBScript
MD5: e84bcb3a32a6dbd9c200a04ddd98e95c
Size: 1.43 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e84bcb3a32a6dbd9c200a04ddd98e95c
Sha1 04853efe4732190c558c3040fc8e55df5ea29a5c
Sha256 e5e44b52a0f49822871439bd790ae6a662d2e462fd1924efb2429c09e13ac79d
Sha384 09232bed2296f8b06f040485d9a5c485bea9bf1010b14bfb35e642e6e71773ccac713ba2ef64a0b243ace12330d587fd
Sha512 1ab0b006d37fcbeb6d0982af4af75cc8e76c862664b3282dec4d838faad71cbde90115cc3a385faea30d20c89b4faaa3ff89503ce76fa8ee6e96607819cc9f1f
SSDeep 24576:csuDXXva104BMeRocDP1NhhQEJBDYkaTz4Mcctdrbf6zncNynD6BRMhUT:cVX//i5oojQc0HUmdruzcNynD6q4
TLSH DE65234D3A678F63C0A915780563CF3843BA5D847B1A8AC37B94B7183DB77A54AD322C
Root Entry
Malicious
䡀䌏䈯
䡀䈖䌧䠤
䡀䌋䄱䜵
䌧䎶䞁䄦䠥
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䈛䌪䗶䜵
䡀䋌䆨㫮䛲
䡀䓞䕪䇤䠨
䡀䕙䓲䕨䜷
䡀䈝䗻䗜䏼䠨
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀㼿䕷䑬㹪䒲䠯
䡀䄛䌧㫲䗸䒷䠱
䡀䕌䄨䈷䒏䇯䕨
䡀䘌䗶䐲䆊䌷䑲
䡀㲊㪿䓳䈜䕤䋦䛎
䡀䈛䒰䈹䈛䌪䗶䜵
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
䡀䄕䑸䋦䒌䇱䗬䒬䠱
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
䡀䒋䗲䗶䄵䓳䕨㲞䈜䘴䑨䈦
SummaryInformation
sysupdate.log
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.edata
.vmp0
.vmp1
.reloc
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.bss
.idata
.didata
.edata
.rdata
.vmp0
.pdata
.vmp1
.vmp2
.reloc
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 2secondary ignored: 2
bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape ole:doc>scr:vbs
malicious 2 nodes
Path ole:doc>pe:dll
Shape ole:doc>pe:dll
2 nodes
Command (COM trace) #1 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #2 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #3 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #4 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #5 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #6 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #7 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #8 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #9 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #10 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #11 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #12 UNKNWOWNmalicious
netsh huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙