Malicious
AutoIt Compiled Script
MD5: 05f8f93fb8a821aade444de558350595
Size: 2.26 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
AutoIt Compiled Script
Size
2.26 MB · 2,256,896 B
First seen
2026-10-07 01:45 · 18 days ago
Last seen
2026-10-07 01:45 · 18 days ago
Last analysis
2026-10-07 01:46 · 18 days ago
Hashes
MD5
05f8f93fb8a821aade444de558350595
Sha1
a50e101f97d2b8a3be2e7a70cf1d0861bb7b48c0
Sha256
ffce7a3896c7e9e8172737d45c1eaed7f62b0a09b65ce22c5eeff9f25b7ace9d
Sha384
492d2102e6057b67d371301e1d1898f4abb98548d2e32917eb609f22045445cc22a351de4b1a5987f23e64b45bf259e2
Sha512
de0e4c19af46ed56bf376d61c3185af95910a710c5ad70e503c17507b162e8c5a067bf32af4eacfee5b8c666b94831d7ab0ebb766339279867f14044018701ed
SSDeep
49152:lXNQlj2FwDS72vwURN26b5fyQnzHSqy3QS0Os:VNQle3ARvb5fbnztyH0O
TLSH
9CA5231227D260B2EDB44BB2D4F74B93C236B4E66E785A8F2788444F1E729C4693171F
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)
8 malicious · 72 files
A3X05f8f93fb8a821aade444de558350595
Structure
BINResources
A3XBumper.a3x
A3Xaut4B23.tmp.tok
A3X[Cleaned].au3
A3X[Deobfuscated].au3
A3X[Deflattened].au3
BIN[Payload 1 hex].bin
BIN[Payload 2 b64].bin
A3XAutoIt3.exe
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 7
STICH kept: 1secondary ignored: 6
bin
4img
2Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:autoit>pe:autoit
Shape
pe:exe>pe:autoit>pe:autoit
malicious
3 nodes
| Name | Value |
|---|---|
| Info | PDB Path: wextract.pdb |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential