Malicious
f4a5495a47897a4cf0e1d59f0a1bdb2f
VBScript
MD5: f4a5495a47897a4cf0e1d59f0a1bdb2f
Size: 209.42 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
209.42 KB · 209,419 B
First seen
2026-08-31 14:15 · one month ago
Last seen
2026-08-31 14:15 · one month ago
Last analysis
2026-09-03 18:14 · one month ago
Hashes
MD5
f4a5495a47897a4cf0e1d59f0a1bdb2f
Sha1
7c6fb1aba7e2e1f00aac5f4e3a6b1194402de905
Sha256
b43ec99720ba404eb34f9c2d4c590ab53785cd05d92b49500ff593a891b6f201
Sha384
355cd689d8a8bf99077903dac2ecf2b1b114cdb849e2d14a011eb923c6ddae092a810caaead3a6722dcd94f3fd0326ff
Sha512
6aef8ab805eeed1bff06149cd0545df44983d985dc49d7756d927fb70038b2bf9d487689706913313134b7f91ab02ab7b136ee1fe911c3b646a4b4be546994a0
SSDeep
3072:o8ggS6skK4Ahkhds0I/vq16fhBS9H5WZHrD4kS7i5OS7saa5fDsEseFE+JM:o8gjQqms0F6pBRD4kn4EIfApe2+W
TLSH
D924479C6A49E8E78384CD43C78C9F6EF05018241B2D639BB664A44B1736F9B19D733E
Detection
Symbol obfuscation
Medium
14 malicious · 15 files
VBSf4a5495a47897a4cf0e1d59f0a1bdb2fT1027 · T1047 · T1059.001
VBSf4a5495a47897a4cf0e1d59f0a1bdb2f.deobfuscated.vbsT1027 · T1047 · T1059.001
PS1[PowerShell Command]T1027 · T1047 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1047~T1059.001~T1059.005>scr:ps1~T1027~T1047~T1059.001~T1059.005
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1047~T1059.001~T1059.005>scr:ps1~T1027~T1059.001~T1059.005
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential14 malicious · 15 files
VBSf4a5495a47897a4cf0e1d59f0a1bdb2fT1027 · T1047 · T1059.001
VBSf4a5495a47897a4cf0e1d59f0a1bdb2f.deobfuscated.vbsT1027 · T1047 · T1059.001
PS1[PowerShell Command]T1027 · T1047 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001 · T1059.005
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
f4a5495a47897a4cf0e1d59f0a1bdb2f
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
f4a5495a47897a4cf0e1d59f0a1bdb2f › f4a5495a47897a4cf0e1d59f0a1bdb2f.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
f4a5495a47897a4cf0e1d59f0a1bdb2f › f4a5495a47897a4cf0e1d59f0a1bdb2f.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
f4a5495a47897a4cf0e1d59f0a1bdb2f › f4a5495a47897a4cf0e1d59f0a1bdb2f.deobfuscated.vbs › [PowerShell Command]
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
f4a5495a47897a4cf0e1d59f0a1bdb2f › f4a5495a47897a4cf0e1d59f0a1bdb2f.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
f4a5495a47897a4cf0e1d59f0a1bdb2f › f4a5495a47897a4cf0e1d59f0a1bdb2f.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account