Open-source atomic malware analysis

Analyze another

cf7bb2a194854f087eafcd7e6257b23c9674dde746bde7b42a3de2afbbfacaf7.wsf

VBS
Verdict: HOSTILE
SHA256: cf7bb2a194854f087eafcd7e6257b23c9674dde746bde7b42a3de2afbbfacaf7 · 97%
Mal-ecule
O(Al)H(F₂)
Size 82.5 KB download
First seen 83 days ago
Analyzed 65 days ago

Objectives

suspicious severity, 90% confident.
anti-analysis/analysis-bomb Rule evaluation timeout: objectives/command-and-control/channel/irc/source::mirc-join-handler-vb6 took 50889ms (limit: 30000ms)
baseline severity, 85% confident.
anti-static/obfuscation/code-metrics Multiple long lines (>1000 chars)
component severity, 85% confident.
command-and-control/dropper ActiveXObject usage (JScript/VBScript)
component severity, 88% confident.
evasion/anti-av/platform ProgramData staged payload directory reference
component severity, 90% confident.
execution/interpreter/script ActiveXObject instantiation call

Micro-behaviors

notable severity, 82% confident.
fs/path ProgramData staging directory path
notable severity, 100% confident.
fs/write Creates a text file using FileSystemObject
baseline severity, 100% confident.
data/encode Loop with step 2
baseline severity, 88% confident.
fs/file VB6 binary file get
component severity, 88% confident.
data/text/keywords Destructive cleanup verb

Metadata

component severity, 90% confident.
file/text Very long line

Identity

SHA-256 cf7bb2a194854f087eafcd7e6257b23c9674dde746bde7b42a3de2afbbfacaf7
Filename cf7bb2a194854f087eafcd7e6257b23c9674dde746bde7b42a3de2afbbfacaf7.wsf

Origin

Source harvest

Timeline

First seen 13 May 2026 08:16 UTC
First analyzed 31 May 2026 10:32 UTC
Last analyzed 31 May 2026 10:32 UTC
Last updated 31 May 2026 10:32 UTC

Labeling

Label bad
Label source harvest
Traits version 52045