Deep Malware Analysis of 2116e13eee17b1725cd8ea6665f28625 | md5: 2116e13eee17b1725cd8ea6665f28625 | Office Document | CAB:COMPRESSION:MSZIP | T1059.001 | T1027 | DeObfuscated | PowerShell

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	2116e13eee17b1725cd8ea6665f28625
Sha1	720bbbd4d2b0ac3c16f2e21fb5b730c40a90348c
Sha256	1fc5375a4158db97631f2f0ed37dfb019b29e2cfec8dd800fa4a38b256efc77f
Sha384	5485f3d3cef4e80ad2485a6cda208ba70158478c3e7b0c3e1a5a995ac8caf8b762aaa6de2e95c681cd0345f88939b886
Sha512	81359959a42010df4ec10ee6f54307a71439367f6b2f7e0793ca1e3d6b04fffd62b37b4b9bb396f160c74e24617fa07a4aed4fc2671b5532148daec508ee1f6e
SSDeep	24576:ufxK1PcpukylEL3CJEdBPHjzWO1UauftimpvpYe0DZp52lHF6Y5mJYAppfSKMxAf:uQSdDSidBLZUamiuX0Df52lMUllRG
TLSH	64B55C636A50600642B5A8FABEBD5E37795F340D101AD98EFFD30B86E51E6F44802E1F

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path ole:doc>scr:ps1~T1027~T1059.001

Shape ole:doc>scr:ps1

malicious 2 nodes

Deobfuscated PowerShell UNKNWOWNmalicious

"$env:huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

"$env:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential