Malicious
PE Executable
MD5: 0ff636fd478af4b4ef4c00cb000caee7
Size: 103.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
103.42 KB · 103,424 B
First seen
2026-08-14 12:46 · 2 months ago
Last seen
2026-08-14 12:46 · 2 months ago
Last analysis
2026-08-14 14:46 · 2 months ago
Hashes
MD5
0ff636fd478af4b4ef4c00cb000caee7
Sha1
222e82e4ca5e7a57bb7733767ca42fd999f8e950
Sha256
88ed1c6d2164f08137cf47668c9ffb55c868d4cfb172bb04198ca954f0bda4b9
Sha384
fae36b5a6b60b0a2f0231b5b6e43feb1ede3506930ee3df875d9368931ae4cdddb8ddf7646f95e436efcc930cfc33eff
Sha512
667b4cbc080d6b02260870a5a5a4f866f511da3adb716aaf0190bec28f9382b4e721186dfa128816e1c43ea65bb72841eed2ee6f2370119cdfc2c607b2087cc3
SSDeep
1536:tm97CZ/1pXrd5N1AxWEBDkvdMqCDv+Lo5N5MKZ:U97c7XTNsWEBDkvyPb+Lo9Z
TLSH
35A34B82B28084F6C5A68639C9D24B859371BC25473923CF37A077691F777D86E7E3A0
Detection
PeID
Armadillo v4.xMicrosoft Visual C++ 8.0Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
6 malicious · 39 files
EXE0ff636fd478af4b4ef4c00cb000caee7T1027 · T1059.001
Structure
BINResources
BINPs1File
PS1CmdFileT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 4
STICH kept: 1secondary ignored: 3
bin
3Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>scr:ps1~T1027~T1059.001
Shape
pe:exe>scr:ps1
malicious
2 nodes
| Name | Value |
|---|---|
| Info | PDB Path: e:\Develope\msi2exe\x64\release\msi2exestub.pdb |
Deobfuscated PowerShell
UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-argumhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential