Malicious
Malicious

f79fe18538c138ad95376f8e3ddfd561

Share on LinkedIn
Print
VBScript
MD5: f79fe18538c138ad95376f8e3ddfd561
Size: 194.83 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 f79fe18538c138ad95376f8e3ddfd561
Sha1 54c529bb08fe2f63e12539cb47a0233bcb1a283f
Sha256 8192cf6cf9edcacb9577d922ada3917a13f0132fca1b294e62c307d71330eec4
Sha384 5ff902c74aca578f7c8c36a3df9a4e8f9a137432ab72cbcc049352a3457f68e4d85cee8b37362cc2eb836fac36949c56
Sha512 cea917b342fb72501377db9dae465f5004eb711c68e6b4225f5edea05b6299854159e144ab6401c84c69b587f25f09c07f8c0153a83abcdf50ac531db3cc8045
SSDeep 3072:Wr3ZI2TNoV0bKQlQ9eSOfSUn+GcJNz8T07zelTW22FbV:2I2TNoVuKQO4SxJN60mli223
TLSH 7F1425B1256E6B47828C3A1ECE55CD2923A317E4EDEB14F47E27511D2E1A7CC0A9F807
f79fe18538c138ad95376f8e3ddfd561
Malicious
f79fe18538c138ad95376f8e3ddfd561.deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:vbs~T1027~T1047~T1059.001~T1059.005>scr:ps1~T1027~T1059.001~T1059.005
Shape scr:vbs>scr:ps1
malicious 2 nodes
Path scr:vbs~T1027~T1047~T1059.001~T1059.005>scr:ps1~T1027~T1047~T1059.001~T1059.005
Shape scr:vbs>scr:ps1
malicious 2 nodes
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
http:huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙