Suspicious
Suspect

fe923d5ee3eecf0f67a8f89fa15a99dc

Share on LinkedIn
Print
VBScript
MD5: fe923d5ee3eecf0f67a8f89fa15a99dc
Size: 5.62 MB
text/vbscript

This sample is a 5.4 MB VBScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 50 embedded or derived files. It matches 17 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2
MD5
fe923d5ee3eecf0f67a8f89fa15a99dc
Verdict
Inconclusive
File type
VBScript · 5.4 MB
MITRE ATT&CK
T1027T1059.007

Cite this report: https://app.malva.re/sha256/dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
5.62 MB · 5,619,226 B
First seen
2026-11-01 11:45 · 8 hours ago
Last seen
2026-11-01 11:45 · 8 hours ago
Last analysis
2026-11-01 11:45 · 8 hours ago
Hashes
MD5 fe923d5ee3eecf0f67a8f89fa15a99dc Sha1 f7b9b1c319582eccd6c356ef49f69b59ac1e26e8 Sha256 dba74d8a8f16ef2438c3d2a9ba7ce4ff8a6da3f7ce7cb779842de8b7010b54c2 Sha384 bd1ac5224374c77f5049c352d521deb8569be2d96e72c74f685e41ba67f8e3e608406feb757cd4986e9eff990a8593de Sha512 3ab951e3d2fec803dc878e2112b9802053b4ef52ea2c7e96295871701f1a2d0e8893fb91bba5da2055e5e3cd0899afe45f12835f1067653c518d7450c7a00cc2 SSDeep 98304:bRIJOtevQngzlysowjQ+IIoNOdFDa2PQorFts7M:bRIJOHnJwjK9NODrrFL TLSH 9F46E11173E84169F5F3AFB599760210E7BABC477A38C28F029495AD1E33BC09A75732
Detection
PeID
MASM/TASM - sig4 (h)Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL
Symbol obfuscation
Medium

51 files
VBSfe923d5ee3eecf0f67a8f89fa15a99dc
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 3secondary ignored: 7
bin 6img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>arc:gz>scr:js~T1027~T1059.007
Shape pe:exe>arc:gz>scr:js
technique3 nodes
Path pe:exe>scr:js~T1059.007
Shape pe:exe>scr:js
technique2 nodes

Name Value
Module Name
shellsense.exe
Full Name
shellsense.exe
EntryPoint
System.Void A.D::A(System.String[])
Scope Name
shellsense.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
shellsense
Assembly Version
0.7.17.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
0
Main Method
System.Void A.D::A(System.String[])
Main IL Instruction Count
10
Main IL 
call System.Void A.d::A()
ldarg A_0
call System.String <PrivateImplementationDetails>{2DA78C35-1448-4A04-888F-94EB0FAC2323}.FE81301C-9868-4711-84B4-89C309F0AD84::u()
call System.Boolean System.Linq.Enumerable::Contains<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.String)
brfalse IL_001E: ldarg A_0
call System.Void A.d::a()
ret <null>
ldarg A_0
call System.Void A.D::a(System.String[])
ret <null>
Info
Overlay extracted: Overlay_50fddd4b.bin (3576858 bytes)
Info
PDB Path: ?

URLs in JS Code - #1 URIsuspect
https:huhuhuhuhuhuhu
URLs in JS Code - #2 URIsuspect
https:huhuhuhuhuhuhu
URLs in JS Code - #1 URIsuspect
http:huhuhuhuhuhuhu
URLs in JS Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #4 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #5 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #6 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #7 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #8 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #9 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #10 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #11 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #12 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #13 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #14 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #15 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙