Malicious
000215417b048b83caf3b3b4aca42bce
PE Executable
MD5: 000215417b048b83caf3b3b4aca42bce
Size: 13.8 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
13.8 MB · 13,796,867 B
First seen
2026-08-19 03:01 · 2 months ago
Last seen
2026-08-19 03:01 · 2 months ago
Last analysis
2026-09-02 10:46 · one month ago
Hashes
MD5
000215417b048b83caf3b3b4aca42bce
Sha1
bf56b79540d8b53d88b679fa3e6661e08711a92a
Sha256
a4b54cb00e44249af6d851b3a8210641287089436c3063dabc69f9af25f78c93
Sha384
2f0768ad59d05d7b92ae31ab1735e49bd549a19e995f0961086f078f322040ec95c533b977b1464b8dba36988e6c459d
Sha512
68d4a1ce562e30b0a60b5b03ed8da8cade83433b0218b6e032c1a79ac0d3ea67142948c5b89365e58c79d01bd67d592d675c7189a9762b37db97db9993b50e9d
SSDeep
196608:ruC206aa7QxaFq3lyPa8CyeJ+F+d9pr/1jfstMh7GavW9kBNQDkzukIfP/RyPXRl:CCN657QxaglMal7+Spr1vNuDfP/IZGU
TLSH
45D63306E79434FCE426C8B4895AC701E7317C856B70D9573B98EE5B2FA3290B92D336
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon
18 malicious · 58 files
EXE000215417b048b83caf3b3b4aca42bceT1027 · T1059 · T1059.001
Structure
RAROverlay_84669adb.binT1027 · T1059 · T1059.001
PS1OpenLink.ps1
EXEae_mixtwo.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINUnity.Interception.Properties.Resources.resources
SNKUnity.Interception.package.snk
DLLNeonBadminton.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
ZIPLX_IfH-00_cpUn.zip
EXE11.exe
Structure
BIN.Net Resources
LISTILRepack.List
BINResources
BINRT_VERSION
BINID:0001
BINID:0
LISTILRepack.List
PS1RunSilent.vbsT1027 · T1059 · T1059.001
BINRunSilent.vbs.deobfuscated.vbs
SH[Command #0]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINID:0011
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
9 / 9
Path
pe:exe~T1059.007>arc:rar~T1059.007>scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:bat
Shape
pe:exe>arc:rar>scr:ps1>scr:bat
malicious
4 nodes
Path
pe:exe~T1059.007>arc:rar~T1059.007>pe:exe>arc:zip>pe:exe>pe:rsrc>bin
Shape
pe:exe>arc:rar>pe:exe>arc:zip>pe:exe>pe:rsrc>bin
technique7 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_84669adb.bin (13316099 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"scriphuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"ko"
huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential18 malicious · 58 files
EXE000215417b048b83caf3b3b4aca42bceT1027 · T1059 · T1059.001
Structure
RAROverlay_84669adb.binT1027 · T1059 · T1059.001
PS1OpenLink.ps1
EXEae_mixtwo.exe
PS1RunSilent.vbsT1027 · T1059 · T1059.001
BINRunSilent.vbs.deobfuscated.vbs
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
BINResources
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
000215417b048b83caf3b3b4aca42bce › Overlay_84669adb.bin › RunSilent.vbs
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
000215417b048b83caf3b3b4aca42bce › Overlay_84669adb.bin › RunSilent.vbs › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"scriphuhuhuhuhuhuhuhuhuhuhu
000215417b048b83caf3b3b4aca42bce › Overlay_84669adb.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
000215417b048b83caf3b3b4aca42bce › Overlay_84669adb.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
000215417b048b83caf3b3b4aca42bce › Overlay_84669adb.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"ko"
huhuhuhuhuhuhuhuhuhuhu
000215417b048b83caf3b3b4aca42bce › Overlay_84669adb.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
000215417b048b83caf3b3b4aca42bce › Overlay_84669adb.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account