Malicious
0ff636fd478af4b4ef4c00cb000caee7
PE Executable
MD5: 0ff636fd478af4b4ef4c00cb000caee7
Size: 103.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
103.42 KB · 103,424 B
First seen
2026-08-14 12:46 · 2 months ago
Last seen
2026-08-14 12:46 · 2 months ago
Last analysis
2026-08-14 14:46 · 2 months ago
Hashes
MD5
0ff636fd478af4b4ef4c00cb000caee7
Sha1
222e82e4ca5e7a57bb7733767ca42fd999f8e950
Sha256
88ed1c6d2164f08137cf47668c9ffb55c868d4cfb172bb04198ca954f0bda4b9
Sha384
fae36b5a6b60b0a2f0231b5b6e43feb1ede3506930ee3df875d9368931ae4cdddb8ddf7646f95e436efcc930cfc33eff
Sha512
667b4cbc080d6b02260870a5a5a4f866f511da3adb716aaf0190bec28f9382b4e721186dfa128816e1c43ea65bb72841eed2ee6f2370119cdfc2c607b2087cc3
SSDeep
1536:tm97CZ/1pXrd5N1AxWEBDkvdMqCDv+Lo5N5MKZ:U97c7XTNsWEBDkvyPb+Lo9Z
TLSH
35A34B82B28084F6C5A68639C9D24B859371BC25473923CF37A077691F777D86E7E3A0
Detection
PeID
Armadillo v4.xMicrosoft Visual C++ 8.0Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
6 malicious · 39 files
EXE0ff636fd478af4b4ef4c00cb000caee7T1027 · T1059.001
Structure
BINResources
BINMSI
BINID:0000
OFFID:1033
BINRoot Entry
BIN䡀䌏䈯
BIN䄧䄷䆾䅤
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䕌䄨䈷䒏䇯䕨
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0080
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
BINPs1File
PS1CmdFileT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 4
STICH kept: 1secondary ignored: 3
bin
3Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>scr:ps1~T1027~T1059.001
Shape
pe:exe>scr:ps1
malicious
2 nodes
| Name | Value |
|---|---|
| Info | PDB Path: e:\Develope\msi2exe\x64\release\msi2exestub.pdb |
Deobfuscated PowerShell
UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-argumhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 39 files
EXE0ff636fd478af4b4ef4c00cb000caee7T1027 · T1059.001
Structure
BINResources
BINPs1File
PS1CmdFileT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
0ff636fd478af4b4ef4c00cb000caee7 › CmdFile › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
-argumhuhuhuhuhuhuhuhuhuhuhu
0ff636fd478af4b4ef4c00cb000caee7 › CmdFile › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account