fe923d5ee3eecf0f67a8f89fa15a99dc

VBScript

MD5: fe923d5ee3eecf0f67a8f89fa15a99dc

Size: 5.62 MB

text/vbscript

This sample is a 5.4 MB VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 50 embedded or derived files. It matches 17 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2
MD5: fe923d5ee3eecf0f67a8f89fa15a99dc
Verdict: Inconclusive
File type: VBScript · 5.4 MB
MITRE ATT&CK: T1027 T1059.007

Cite this report: https://app.malva.re/sha256/dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

VBScript file

Size

5.62 MB · 5,619,226 B

First seen

2026-11-01 11:45 · 9 hours ago

Last seen

2026-11-01 11:45 · 9 hours ago

Last analysis

2026-11-01 11:45 · 9 hours ago

Hashes

MD5 fe923d5ee3eecf0f67a8f89fa15a99dc Sha1 f7b9b1c319582eccd6c356ef49f69b59ac1e26e8 Sha256 dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2 Sha384 bd1ac5224374c77f5049c352d521deb8569be2d96e72c74f685e41ba67f8e3e608406feb757cd4986e9eff990a8593de Sha512 3ab951e3d2fec803dc878e2112b9802053b4ef52ea2c7e96295871701f1a2d0e8893fb91bba5da2055e5e3cd0899afe45f12835f1067653c518d7450c7a00cc2 SSDeep 98304:bRIJOtevQngzlysowjQ+IIoNOdFDa2PQorFts7M:bRIJOHnJwjK9NODrrFL TLSH 9F46E11173E84169F5F3AFB599760210E7BABC477A38C28F029495AD1E33BC09A75732

Detection

PeID

MASM/TASM - sig4 (h)Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL

Symbol obfuscation

Medium

51 files

VBSfe923d5ee3eecf0f67a8f89fa15a99dc

Structure

BIN.Net Resources

GZShellsense.Payload

JSfile_0.bin

DLLShellsense.Assemblies.Microsoft.Web.WebView2.Core.dll

Structure

P7B[Authenticode]_372c79c7.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

DLLShellsense.Assemblies.Microsoft.Web.WebView2.WinForms.dll

Structure

P7B[Authenticode]_cec66318.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BMPMicrosoft.Web.WebView2.WinForms.Microsoft.Web.WebView2.WinForm.WebView2.bmp

DLLShellsense.Native.WebView2Loader.dll

Structure

P7B[Authenticode]_1eff728b.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:1033

JSShellsense.Vendor.firebase-app-compat.js

JSShellsense.Vendor.firebase-auth-compat.js

JSShellsense.Vendor.firebaseui.js

CSSShellsense.Vendor.firebaseui.css

BINShellsense.Vendor.fonts

CSSfonts.css

BINnunito-cyrillic-ext-wght-normal.woff2

BINnunito-cyrillic-wght-normal.woff2

BINnunito-latin-ext-wght-normal.woff2

BINnunito-latin-wght-normal.woff2

BINnunito-vietnamese-wght-normal.woff2

BINroboto-cyrillic-ext-wght-normal.woff2

BINroboto-cyrillic-wght-normal.woff2

BINroboto-greek-ext-wght-normal.woff2

BINroboto-greek-wght-normal.woff2

BINroboto-latin-ext-wght-normal.woff2

BINroboto-latin-wght-normal.woff2

BINroboto-math-wght-normal.woff2

BINroboto-symbols-wght-normal.woff2

BINroboto-vietnamese-wght-normal.woff2

BINsigmar-one-latin-400-normal.woff2

BINsigmar-one-latin-ext-400-normal.woff2

BINsigmar-one-vietnamese-400-normal.woff2

BINnunito-LICENSE

BINroboto-LICENSE

BINsigmar-one-LICENSE

BINShellsense.Vendor.LICENSE

MDShellsense.Vendor.README.md

TXTShellsense.Licenses.WebView2-LICENSE.txt

TXTShellsense.Licenses.WebView2-NOTICE.txt

VBSOverlay_50fddd4b.bin

Structure

BINOverlay_6ec08ce3.bin

BINResources

BINRT_RCDATA

BINID:0065

EXEID:1033

Structure

BINRT_MANIFEST

BINID:0001

BINID:1033

BINResources

BINRT_ICON

BINID:0001

IMGID:0

IMGID:0-preview.png

BINRT_GROUP_CURSOR4

BINID:7F00

BINID:0

BINRT_VERSION

BINID:0001

BINID:0

BINRT_MANIFEST

BINID:0001

BINID:0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 3secondary ignored: 7

bin 6img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>arc:gz>scr:js~T1027~T1059.007

Shape pe:exe>arc:gz>scr:js

technique3 nodes

Path pe:exe>scr:js~T1059.007

Shape pe:exe>scr:js

technique2 nodes

Name	Value
Module Name	shellsense.exe
Full Name	shellsense.exe
EntryPoint	System.Void A.D::A(System.String[])
Scope Name	shellsense.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	shellsense
Assembly Version	0.7.17.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	0
Main Method	System.Void A.D::A(System.String[])
Main IL Instruction Count	10
Main IL	call System.Void A.d::A() ldarg A_0 call System.String <PrivateImplementationDetails>{2DA78C35-1448-4A04-888F-94EB0FAC2323}.FE81301C-9868-4711-84B4-89C309F0AD84::u() call System.Boolean System.Linq.Enumerable::Contains<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.String) brfalse IL_001E: ldarg A_0 call System.Void A.d::a() ret <null> ldarg A_0 call System.Void A.D::a(System.String[]) ret <null>
Info	Overlay extracted: Overlay_50fddd4b.bin (3576858 bytes)
Info	PDB Path: ?

URLs in JS Code - #1 URIsuspect

https:huhuhuhuhuhuhu

URLs in JS Code - #2 URIsuspect

https:huhuhuhuhuhuhu

URLs in JS Code - #1 URIsuspect

http:huhuhuhuhuhuhu

URLs in JS Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #4 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #5 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #6 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #7 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #8 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #9 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #10 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #11 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #12 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #13 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #14 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in JS Code - #15 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

51 files

VBSfe923d5ee3eecf0f67a8f89fa15a99dc

Structure

BIN.Net Resources

VBSOverlay_50fddd4b.bin

BINResources

No malware configuration was found at this point.

URLs in JS Code - #1 URIsuspect

https:huhuhuhuhuhuhu

fe923d5ee3eecf0f67a8f89fa15a99dc › .Net Resources › Shellsense.Payload › file_0.bin

URLs in JS Code - #2 URIsuspect

https:huhuhuhuhuhuhu

fe923d5ee3eecf0f67a8f89fa15a99dc › .Net Resources › Shellsense.Payload › file_0.bin

URLs in JS Code - #1 URIsuspect

http:huhuhuhuhuhuhu

fe923d5ee3eecf0f67a8f89fa15a99dc › .Net Resources › Shellsense.Vendor.firebase-auth-compat.js

URLs in JS Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

fe923d5ee3eecf0f67a8f89fa15a99dc › .Net Resources › Shellsense.Vendor.firebase-auth-compat.js

URLs in JS Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

fe923d5ee3eecf0f67a8f89fa15a99dc › .Net Resources › Shellsense.Vendor.firebase-auth-compat.js

URLs in JS Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu