Malicious PE Executable analysis – fe892c485599

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

4.4 MB · 4,404,736 B

First seen

2026-09-08 02:15 · one month ago

Last seen

2026-09-08 02:15 · one month ago

Last analysis

2026-09-08 02:16 · one month ago

Hashes

MD5 19f88273e1076a090e4ec439c2ee560c Sha1 6fe767347543cf94386c17d98306ffd2798b2438 Sha256 fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6 Sha384 e05f75d89d4438818d62675dfe433b89a5b16d754ec151b10a6dc665f77a22b9116386e7c2941a8bcc5828ac10c757a2 Sha512 99fe74f4d23f122e54bf44b0f989910506215fa623baf03df9453f7e676c562b9808ba0404d73b6b78aa757d227c9ddc22cb35167511ea797f65aaf3fd83ab4a SSDeep 98304:jnsmtk2aaAD1e6OE6wDSUIEgzD/NrS27fgAf1HKcU/Y/:7LhADzOEpSUhglu27oAf5t TLSH 18161222B2D18437D1322A3C9C6BA3A5583EBE513D38764E7BE91D4C8F396423D652D3

Detection

PeID

BobSoft Mini Delphi -> BoB / BobSoftBorland Delphi 4.0Borland Delphi v3.0Borland Delphi v6.0 - v7.0Borland Delphi v6.0 - v7.0D1S1G v1.1 beta --> D1ND1S1G v1.1 beta --> D1NMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John ReiserUPX v2.0 -> Markus, Laszlo & ReiserUPolyX 0.3 -> delikon

10 malicious · 686 files

EXE19f88273e1076a090e4ec439c2ee560c

Structure

7Z7z-stream @ 0x00194E2A.7z

BINConfig

XMLconfig.xml

BINdefaultskin

ZIPdefaultskin.ui

VBSMiniUI.xml

VBSMiniUI.xml.deobfuscated.vbs

IMGSkin.jpg

BINnetmon

DLL360Base.dll

DLL360Conf.dll

DLL360net.dll

DLL360NetBase.dll

DLL360NetUL.dll

DLL360P2SP.dll

DLL360Util.dll

DLL360Verify.dll

DLLCrashReport.dll

BINipc

DLLLiveUpd360.dll

DLLPDown.dll

BINsafemon

BINResources

BINRT_CURSOR

BINRT_BITMAP

BINRT_ICON

BINRT_DIALOG

BINRT_STRING

BINRT_RCDATA

BINID:0000

BINID:0

XLSID:1055

Structure

BINResources

XML[Content_Types].xml

BIN_rels

BINxl

BIN_rels

XMLworkbook.xml

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

VBAThisWorkbook

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

BIN_VBA_PROJECT

BINtheme

XMLstyles.xml

BINworksheets

BINdocProps

BINRT_GROUP_CURSOR2

BINRT_GROUP_CURSOR4

BINRT_VERSION

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 24 STICH kept: 12secondary ignored: 12

bin 9img 3

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

12 / 12

Path pe:exe>pe:rsrc>oox:xlsm~T1027~T1059.005~T1112>oox:vba~T1027~T1059.005~T1112

Shape pe:exe>pe:rsrc>oox:xlsm>oox:vba

malicious 4 nodes

Path pe:exe>pe:rsrc>oox:xlsm~T1027~T1059.005~T1112>oox:vba~T1059.005

Shape pe:exe>pe:rsrc>oox:xlsm>oox:vba

malicious 4 nodes

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	ThisWorkbook	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.