Suspicious
Suspect

04d520b7cb740d8a5a0681fb9086d4bc

VBScript
MD5: 04d520b7cb740d8a5a0681fb9086d4bc
Size: 16.81 MB
text/vbscript

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 04d520b7cb740d8a5a0681fb9086d4bc
Sha1 c890551096599361618415728958285965639658
Sha256 08302ac73bd9427e59aca76baff9b0c9738618c4a83c014e9a234ecc5bdd1e4e
Sha384 97d74545583c9b94ab35797f0098a7a5f98e7d4a38c1bb2ff7ad03ea12c132578473824b2c1173c9947684fad2028446
Sha512 b1093128b98857c3078a0843b1b4605ccdb6ddb219f8c09ccf08184934ef3d7993433d7418303c2ec1a914019f4d3be45c33dc9bc34928ef212d442dd51a016f
SSDeep 196608:dIdhR+ODc9vOp3k7qwm8mgrgIFPH+GN4NkVxDHWKoIl:dobOu0WlgrRPeGDVVjX
TLSH 0E079D47ED6514E4C4ADC2358A625223BB317C491B2123D72BA0F6386F73BE05EFA764
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.xdata
.idata
.reloc
.symtab
.rsrc
.gfids
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0003
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:1033
[Base64-Block@0x00526AAD]
[Base64-Block-Decoded]
[Base64-Block@0x00534F16]
[Base64-Block-Decoded]
04d520b7cb740d8a5a0681fb9086d4bc
[Base64-Block@0x00EED315]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 2secondary ignored: 2
bin 1img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>enc:b64
Shape pe:exe>enc:b64
2 nodes
Path pe:exe>html
Shape pe:exe>html
2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.xdata
.idata
.reloc
.symtab
.rsrc
.gfids
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0003
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:1033
[Base64-Block@0x00526AAD]
[Base64-Block-Decoded]
[Base64-Block@0x00534F16]
[Base64-Block-Decoded]
04d520b7cb740d8a5a0681fb9086d4bc
[Base64-Block@0x00EED315]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙