1772eac5be0b215cb982b38b749b9e79

PE Executable
|
MD5: 1772eac5be0b215cb982b38b749b9e79
|
Size: 646.48 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	1772eac5be0b215cb982b38b749b9e79
Sha1	edf753eda3fa9f936f036c94fb85fff732923b45
Sha256	d733c598df62dae156c7ea43eba97a49cb69503a56153eda9b7e899749a2903c
Sha384	d1e46c7630655812ea1964bb0b0d318ba933a9c132ad76e7060e87da2949ffc5a921317e929ed07ca76cac9e500f13e1
Sha512	c53108a73235fce0016b8452e242786a836be1f92575b57f5088c8dbf3af296c82db80713640e277290d5853188e3a588e2ff4ebda67958e5e7706183d7f63d7
SSDeep	12288:Q6j1dEoLO166Bwd/a6DjskTeac0VKet632Q/KRJ9lcWTUYhjAbiSBRrYkga35N:QEOoLOBBwdC6DjshaCGS2QSZlc2UQx4H
TLSH	94D4F12276E2C877C66221318EDD6BB6B1F6E7090F25488713C48B5E9B349E0D73927D

PeID

Microsoft Visual C++

Microsoft Visual C++ 5.0

Microsoft Visual C++ 6.0 DLL (Debug)

Microsoft Visual C++ 7.0 - 8.0

Microsoft Visual C++ v6.0

Microsoft Visual C++ v6.0 DLL

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_c001c07c.bin (431948 bytes)

Artefacts

Name0	Value
Deobfuscated PowerShell	^ "$t='%TARGET%';" ^ "$p=[Environment]::GetEnvironmentVariable('Path','User');" ^ "if([string]::IsNullOrEmpty($p)){ $new=$t } elseif(($p.Split(';') -notcontains $t)){ $new=$p.TrimEnd(';')+';'+$t } else { $new=$p };" ^ "[Environment]::SetEnvironmentVariable('Path',$new,'User')" Write-Output "Fini." "Le" "PATH" "a" "été" "modifié." "Toute" "application" "déjà" "ouverte" "ne" "prendra" "pas" "en" "compte" "les" "modifications." Pause endlocal
Deobfuscated PowerShell	^ "$t='%TARGET%';" ^ "$p=[Environment]::GetEnvironmentVariable('Path','User');" ^ "if([string]::IsNullOrEmpty($p)){ $new=$t } elseif(($p.Split(';') -notcontains $t)){ $new=$p.TrimEnd(';')+';'+$t } else { $new=$p };" ^ "[Environment]::SetEnvironmentVariable('Path',$new,'User')" Write-Output "C'EST FINI" Write-Output "Relancez le script tant qu'il n'est pas indiqué 'there is nothing to do' ou 'Il n'y a rien à faire' 2 lignes au dessus ce celle-ci" Pause endlocal

Name0

Value

Deobfuscated PowerShell

1772eac5be0b215cb982b38b749b9e79 (646.48 KB)

File Structure

Characteristics

No malware configuration were found at this point.

Artefacts

Name0	Value	Location
Deobfuscated PowerShell	^ "$t='%TARGET%';" ^ "$p=[Environment]::GetEnvironmentVariable('Path','User');" ^ "if([string]::IsNullOrEmpty($p)){ $new=$t } elseif(($p.Split(';') -notcontains $t)){ $new=$p.TrimEnd(';')+';'+$t } else { $new=$p };" ^ "[Environment]::SetEnvironmentVariable('Path',$new,'User')" Write-Output "Fini." "Le" "PATH" "a" "été" "modifié." "Toute" "application" "déjà" "ouverte" "ne" "prendra" "pas" "en" "compte" "les" "modifications." Pause endlocal Malicious	1772eac5be0b215cb982b38b749b9e79 > 7z-stream @ 0x00034600.7z > NSI-SCRIPTS > 2.INSTALL-MSYS2.bat > [PowerShell Command]
Deobfuscated PowerShell	^ "$t='%TARGET%';" ^ "$p=[Environment]::GetEnvironmentVariable('Path','User');" ^ "if([string]::IsNullOrEmpty($p)){ $new=$t } elseif(($p.Split(';') -notcontains $t)){ $new=$p.TrimEnd(';')+';'+$t } else { $new=$p };" ^ "[Environment]::SetEnvironmentVariable('Path',$new,'User')" Write-Output "C'EST FINI" Write-Output "Relancez le script tant qu'il n'est pas indiqué 'there is nothing to do' ou 'Il n'y a rien à faire' 2 lignes au dessus ce celle-ci" Pause endlocal Malicious	1772eac5be0b215cb982b38b749b9e79 > 7z-stream @ 0x00034600.7z > NSI-SCRIPTS > 3.MAJ-MSYS2.bat > [PowerShell Command]

You must be signed in to post a comment.