Malicious
VBScript
MD5: f8eba621632c582c6cf585a75e30491b
Size: 1.01 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
1.01 MB · 1,007,888 B
First seen
2026-08-31 14:15 · one month ago
Last seen
2026-08-31 14:15 · one month ago
Last analysis
2026-09-03 18:14 · one month ago
Hashes
MD5
f8eba621632c582c6cf585a75e30491b
Sha1
f52afd037d06001fba0f3b86ee266fdccf42ed57
Sha256
3d536fa8ca0e9433d505e9af93347b1d64d2aa8f4a440a6ffb9c63f1d7a1d4a3
Sha384
2df2f826b28709d6130d87021726d883e86fb5fef35276e9b89b88fc20e2d2039bd4f1439cd021ce293be6c8dfbe68aa
Sha512
fde6d1bdab68b0c0953b25f4fdc730f908960efef30f2af045510863d9e1d7326636a5beac18daeaa4fec38b5961888c9d820749c534e979cdbefbc34191bc30
SSDeep
24576:Lk0rcykWRpa1xYTK0yLU4zWbype1iTKwXi3zF44:LkgY1GPwL65Z
TLSH
EB2501454FCEBBE58298997C035A361E26BC0A7C249CB5F4B3EC2845A39BED753460DC
Detection
Symbol obfuscation
Medium
14 malicious · 15 files
VBSf8eba621632c582c6cf585a75e30491bT1027 · T1047 · T1105
VBSf8eba621632c582c6cf585a75e30491b.deobfuscated.vbsT1027 · T1047 · T1105
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1047 · T1105
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001 · T1059.005
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Path
scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1047~T1059.001~T1059.005~T1105
Shape
scr:vbs>scr:ps1
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential