Malicious
PE Executable
MD5: 000215417b048b83caf3b3b4aca42bce
Size: 13.8 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
13.8 MB · 13,796,867 B
First seen
2026-08-19 03:01 · 2 months ago
Last seen
2026-08-19 03:01 · 2 months ago
Last analysis
2026-09-02 10:46 · one month ago
Hashes
MD5
000215417b048b83caf3b3b4aca42bce
Sha1
bf56b79540d8b53d88b679fa3e6661e08711a92a
Sha256
a4b54cb00e44249af6d851b3a8210641287089436c3063dabc69f9af25f78c93
Sha384
2f0768ad59d05d7b92ae31ab1735e49bd549a19e995f0961086f078f322040ec95c533b977b1464b8dba36988e6c459d
Sha512
68d4a1ce562e30b0a60b5b03ed8da8cade83433b0218b6e032c1a79ac0d3ea67142948c5b89365e58c79d01bd67d592d675c7189a9762b37db97db9993b50e9d
SSDeep
196608:ruC206aa7QxaFq3lyPa8CyeJ+F+d9pr/1jfstMh7GavW9kBNQDkzukIfP/RyPXRl:CCN657QxaglMal7+Spr1vNuDfP/IZGU
TLSH
45D63306E79434FCE426C8B4895AC701E7317C856B70D9573B98EE5B2FA3290B92D336
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon
18 malicious · 58 files
EXE000215417b048b83caf3b3b4aca42bceT1027 · T1059 · T1059.001
Structure
RAROverlay_84669adb.binT1027 · T1059 · T1059.001
PS1OpenLink.ps1
EXEae_mixtwo.exe
PS1RunSilent.vbsT1027 · T1059 · T1059.001
BINRunSilent.vbs.deobfuscated.vbs
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
9 / 9
Path
pe:exe~T1059.007>arc:rar~T1059.007>scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:bat
Shape
pe:exe>arc:rar>scr:ps1>scr:bat
malicious
4 nodes
Path
pe:exe~T1059.007>arc:rar~T1059.007>pe:exe>arc:zip>pe:exe>pe:rsrc>bin
Shape
pe:exe>arc:rar>pe:exe>arc:zip>pe:exe>pe:rsrc>bin
technique7 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_84669adb.bin (13316099 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"scriphuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"ko"
huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential