f17f63e5886a6f2f569294bb22067bed

VBScript

MD5: f17f63e5886a6f2f569294bb22067bed

Size: 436.22 KB

text/vbscript

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	f17f63e5886a6f2f569294bb22067bed
Sha1	f0a069b77719cec8067de43e5dc109025aa6e836
Sha256	5b679e7350067248c1a890f198155e4cf794d620a654a7f7479829575799c15a
Sha384	102e045eddca367acbe4abc2b9c313be4bb190f4b8b8da06a66a10232f58791079fcb5d8d70c40359fd74dcbf0392890
Sha512	6208b7b72572bf78e8161a3d5baccbccd028e8a6f43f6e72bfb7b259bacf83a6613b0d7313b880f74ba3865a88125e21d11bf106756db76f0ec888f37f436976
SSDeep	768:PoGPfNsvkKFScNb4OQ9+xfH8yCN/ggHAa6xL/PZzdyUZKDMbJ6ipgoX8SUES0:wgVykxihA+xv8ygxhUzqUQMXGosP
TLSH	1094AF0EF307546CC62B863844A6C238F273B402A4B15A2F35ACF55A4F73DA9976BF45

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 5secondary ignored: 4

oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

5 / 5

Path scr:vbs>scr:vbs~T1059.005>scr:bat

Shape scr:vbs>scr:vbs>scr:bat

malicious 3 nodes

Path scr:vbs>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001

Shape scr:vbs>scr:vbs>scr:ps1

malicious 3 nodes

Name	Value
ISO	DiskImage extraction mode: DiscUtils (ISO)

Deobfuscated PowerShell UNKNWOWNmalicious

param(huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

& runphuhuhuhuhuhuhuhuhuhuhu

LNK: Script Execution UNKNWOWNmalicious

wscriphuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Deobfuscated PowerShell UNKNWOWNmalicious

param(huhuhuhuhuhuhuhuhuhuhu

f17f63e5886a6f2f569294bb22067bed › Resources › run.ps1 › [Deobfuscated PS]

Deobfuscated PowerShell UNKNWOWNmalicious

& runphuhuhuhuhuhuhuhuhuhuhu

f17f63e5886a6f2f569294bb22067bed › Resources › launcher.vbs › [PowerShell Command]

LNK: Script Execution UNKNWOWNmalicious

wscriphuhuhuhuhuhuhuhuhuhuhu

f17f63e5886a6f2f569294bb22067bed › Акт сверки 2026.docx.lnk

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.