Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
File Type
Portable Executable file
Detection PeID
Microsoft Visual C++ Microsoft Visual C++ 5.0 Microsoft Visual C++ 6.0 DLL (Debug) Microsoft Visual C++ 7.0 - 8.0 Microsoft Visual C++ v6.0 Microsoft Visual C++ v6.0 Microsoft Visual C++ v6.0 DLL
11 malicious · 70 files
Malicious chain only
Expand all
EXE 1772eac5be0b215cb982b38b749b9e79 PE32 x86 Structure
DosHeader PE Header Optional Header (x86) .text .rdata .data .sxdata .rsrc 7Z 7z-stream @ 0x00034600.7z extracted from PE Executable · 7Zip Archive BAT 0.OPEN-EXPLORER.bat extracted from 7Zip Archive PS1 1.INSTALL-VSCODE-UV.bat extracted from 7Zip Archive · PowerShell PS1 [PowerShell Command] code extracted · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 2.INSTALL-MSYS2.bat extracted from 7Zip Archive · PowerShell PS1 [PowerShell Command] code extracted · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 3.MAJ-MSYS2.bat extracted from 7Zip Archive · PowerShell PS1 [PowerShell Command] code extracted · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell BAT 4.DESTROY.bat extracted from 7Zip Archive TAR dvdrental.tar extracted from 7Zip Archive · Tar Archive BAT install-c.bat extracted from 7Zip Archive BAT install-elm.bat extracted from 7Zip Archive BAT install-graphviz.bat extracted from 7Zip Archive BAT install-ocaml.bat extracted from 7Zip Archive BAT install-postgres.bat extracted from 7Zip Archive BAT install-qemu.bat extracted from 7Zip Archive BAT install-rust.bat extracted from 7Zip Archive BAT postgres-start.bat extracted from 7Zip Archive BAT postgres-stop.bat extracted from 7Zip Archive TOML pyproject.toml extracted from 7Zip Archive BAT RunMSYS2Cmd.bat extracted from 7Zip Archive JSON settings.json extracted from 7Zip Archive BAT NSI-sauver.bat extracted from 7Zip Archive BAT NSI-importer.bat extracted from 7Zip Archive
Name
Value Info
Overlay extracted: Overlay_c001c07c.bin (431948 bytes)
Deobfuscated PowerShell
UNKNWOWN malicious
^
"$t huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWN malicious
^
"$t huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
11 malicious · 70 files
Malicious chain only
Expand all
EXE 1772eac5be0b215cb982b38b749b9e79 PE32 x86 Structure
DosHeader PE Header Optional Header (x86) .text .rdata .data .sxdata .rsrc 7Z 7z-stream @ 0x00034600.7z extracted from PE Executable · 7Zip Archive BAT 0.OPEN-EXPLORER.bat extracted from 7Zip Archive PS1 1.INSTALL-VSCODE-UV.bat extracted from 7Zip Archive · PowerShell PS1 [PowerShell Command] code extracted · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 2.INSTALL-MSYS2.bat extracted from 7Zip Archive · PowerShell PS1 [PowerShell Command] code extracted · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 3.MAJ-MSYS2.bat extracted from 7Zip Archive · PowerShell PS1 [PowerShell Command] code extracted · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell BAT 4.DESTROY.bat extracted from 7Zip Archive TAR dvdrental.tar extracted from 7Zip Archive · Tar Archive BAT install-c.bat extracted from 7Zip Archive BAT install-elm.bat extracted from 7Zip Archive BAT install-graphviz.bat extracted from 7Zip Archive BAT install-ocaml.bat extracted from 7Zip Archive BAT install-postgres.bat extracted from 7Zip Archive BAT install-qemu.bat extracted from 7Zip Archive BAT install-rust.bat extracted from 7Zip Archive BAT postgres-start.bat extracted from 7Zip Archive BAT postgres-stop.bat extracted from 7Zip Archive TOML pyproject.toml extracted from 7Zip Archive BAT RunMSYS2Cmd.bat extracted from 7Zip Archive JSON settings.json extracted from 7Zip Archive BAT NSI-sauver.bat extracted from 7Zip Archive BAT NSI-importer.bat extracted from 7Zip Archive
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWN malicious
^
"$t huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWN malicious
^
"$t huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.
