Deep Malware Analysis of Game.msi | md5: 079c604ca9d4ebacec36b835becf90fa | Office Document | CAB:COMPRESSION:MSZIP | CAB:COMPRESSION:NONE | Executable | PE (Portable Executable) | PE File Layout | PDB Path | SVG | PowerShell | T1059.001 | T1027 | DeObfuscated | T1105

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	079c604ca9d4ebacec36b835becf90fa
Sha1	dfb972406bcbab626027de10ce444269af821271
Sha256	2db5407d7c139f91b1db26df889976c624ac14c0ddcec7e982bf2dfd4e1d7871
Sha384	a972c3c5cd22c3cb14da0cad77da3692adb4bdc69b2b842af9625333f184afcccdd7f37c8479d4eb04ad2fe50306b2e7
Sha512	f528dd0e989460531528b6759f4d1bdef146f76403f04ab72ba8ca402bc313ab07ca761beb0e7b4fc30d2130e1e77ffc0ac3a4ef2e5a8b98a0a1b130a7139880
SSDeep	393216:o7whGcEtJvtALyBWYJRny5tUabGYVqmqqZ1XTTcftUYLQK3+jPhGv:Y2GPtgOBWYHny5G4GYVzqg1XTqtL93
TLSH	F71733A668336C47CA64B57B63536360AF310DB03B0287492E75F8AD1CFE0F95A59387

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 14 STICH kept: 5secondary ignored: 9

bin 6img 3

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

5 / 5

Path ole:doc>bin>scr:ps1~T1027~T1059.001~T1105

Shape ole:doc>bin>scr:ps1

malicious 3 nodes

Path ole:doc>bin>html>enc:b64

Shape ole:doc>bin>html>enc:b64

4 nodes

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #5	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4	https:huhuhuhuhuhuhu
URL in PowerShell #5	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #8	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #9	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #10	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #11	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #12	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #13	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #17	https:huhuhuhuhuhuhu
URL in PowerShell #18	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #19	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #20	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #21	https:huhuhuhuhuhuhu
URL in PowerShell #22	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #23	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #24	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #25	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #26	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #27	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #28	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #29	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #30	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #31	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #32	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #33	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #34	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #35	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #36	https:huhuhuhuhuhuhu
URL in PowerShell #37	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #38	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #39	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #40	https:huhuhuhuhuhuhu
URL in PowerShell #41	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #42	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #43	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #44	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #45	https:huhuhuhuhuhuhu
URL in PowerShell #46	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #47	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #48	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #49	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #50	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #51	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #52	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #53	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #54	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #55	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #56	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #57	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #58	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #59	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #60	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #61	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #62	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #63	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #64	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #65	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #66	https:huhuhuhuhuhuhu
URL in PowerShell #67	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #68	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #69	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #70	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #71	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #72	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #73	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #74	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #75	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #76	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #77	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #78	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #79	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #80	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #81	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #82	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #83	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #84	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #85	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #86	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #87	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #88	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #89	https:huhuhuhuhuhuhu
URL in PowerShell #90	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #91	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #92	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #93	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #94	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #95	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #96	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #97	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #98	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #99	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #100	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #5	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #8	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #9	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #10	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #11	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #12	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #13	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #17	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #18	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #19	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #20	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #21	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #22	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #23	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #24	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #25	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #26	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #27	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #28	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #29	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #30	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #31	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #32	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #33	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #34	https:huhuhuhuhuhuhu
URL in PowerShell #35	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #36	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #37	https:huhuhuhuhuhuhu
URL in PowerShell #38	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #39	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #40	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #41	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #42	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #43	https:huhuhuhuhuhuhu
URL in PowerShell #44	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #45	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #46	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #47	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #48	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #49	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #50	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #51	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #52	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #53	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #54	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #55	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #56	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #57	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #58	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #59	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #60	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #61	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #62	https:huhuhuhuhuhuhu
URL in PowerShell #63	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #64	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #65	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #66	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #67	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #68	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #69	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #70	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #71	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #72	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #73	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #74	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #75	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #76	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #77	https:huhuhuhuhuhuhu
URL in PowerShell #78	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #79	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #80	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #81	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #82	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #83	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #84	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #2 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #3 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #4 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #5 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #6 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu