Suspect
068948bd7e237ce49dffa1a8e78eaae8
PE Executable
MD5: 068948bd7e237ce49dffa1a8e78eaae8
Size: 13.61 MB
application/x-dosexec
This sample is a 13 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 11 embedded or derived files. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- baf1b5d49623ad32cef0b3ce4b7d2cde4b205bf4c0f20968c9190a6c6d462fcc
- MD5
- 068948bd7e237ce49dffa1a8e78eaae8
- Verdict
- Inconclusive
- File type
- PE Executable · 13 MB
- MITRE ATT&CK
- T1059.007
Cite this report: https://app.malva.re/sha256/baf1b5d49623ad32cef0b3ce4b7d2cde4b205bf4c0f20968c9190a6c6d462fcc
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
13.61 MB · 13,606,382 B
Hashes
MD5
068948bd7e237ce49dffa1a8e78eaae8
Sha1
fca527166487e5a5217115a572cea62a06d79840
Sha256
baf1b5d49623ad32cef0b3ce4b7d2cde4b205bf4c0f20968c9190a6c6d462fcc
Sha384
6c8de03c7ac4aba14f97af22c9f0cb8184ddfedf859dd6a824aef6a09babdde13ac484f6cfa3b2c1b386e2f9814aae23
Sha512
e885eaa83e73a95e123951d61eb58978dc1c0769dbb6bdc5852f3644d88060f8ed3812651e06a1864a09d513427aba64d3401e3c904579cba885af1e488f6ff7
SSDeep
393216:h1oW0lLW8lL+8dQusl3VrAZYCuPJO4E3+d94egMP9:h1oWAW8lK8dQuOCJuxmOd94zMF
TLSH
D3D63388775D0CDDE95F4735A8E5570763C2B9B353A0C2EF1BA009460A9B1E8FEB5B20
Detection
PeID
Microsoft Visual C++ 8.0Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
12 files
EXE068948bd7e237ce49dffa1a8e78eaae8T1059.007
Structure
JSOverlay_3c21b735.binT1059.007
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
IMGID:0
IMGID:0-preview.png
BINID:0005
BINID:0
BINID:0006
BINID:0
BINID:0007
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
pe:exe~T1059.007>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
technique3 nodes
Path
pe:exe~T1059.007>pe:rsrc>img
Shape
pe:exe>pe:rsrc>img
technique3 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_3c21b735.bin (13273582 bytes) |
| Info | PDB Path: t$mn |
12 files
EXE068948bd7e237ce49dffa1a8e78eaae8T1059.007
Structure
JSOverlay_3c21b735.binT1059.007
BINResources
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account