Malicious
AutoIt Compiled Script
MD5: 00e4147f5e232c04d27d48fff55abf96
Size: 1.77 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
AutoIt Compiled Script
Size
1.77 MB · 1,768,960 B
First seen
2026-07-19 22:15 · 3 months ago
Last seen
2026-07-19 22:15 · 3 months ago
Last analysis
2026-07-19 22:15 · 3 months ago
Hashes
MD5
00e4147f5e232c04d27d48fff55abf96
Sha1
794dd38cf7afcd86b2420ccc3d65c7b2bc4aaba5
Sha256
b0f43bcb2af128106bda1ac0495f70028d364056e4a9521e4e06f1b83769e022
Sha384
81dcccf218ffb67bf9b1af1f98e4d046b9634ab991e1bf81438cc5d984b95825e064b89e94eca3321ca0103b529cbb44
Sha512
15fad8794ae2b60aca5cab52fe9602de51472f0126aefce6b30d8ae567ba6b257529766e66a4f933d8409fd39f81f5b7e665168794f21b311b6940da6648e2cd
SSDeep
49152:HkfovDwaxCH/WmLWoi3xS0TASv9hiXScHQ:DEu34crv9YScw
TLSH
8C852353A7E88163F6A6377CA8F11323B2793CA01B7393DF5A406A9C29337C65531726
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)
4 malicious · 66 files
A3X00e4147f5e232c04d27d48fff55abf96
Structure
P7B[Authenticode]_61f1ec07.p7b
BINResources
A3XGreece.a3x
A3Xaut659F.tmp.tok
A3X[Cleaned].au3
EXEAutoIt3.exe
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 8
STICH kept: 1secondary ignored: 7
bin
5img
2Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:autoit>pe:autoit
Shape
pe:exe>pe:autoit>pe:autoit
malicious
3 nodes
| Name | Value |
|---|---|
| Info | Authenticode present at 0x1AD200 size 11264 bytes |
| Info | PDB Path: wextract.pdb |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential