Malicious
216f1fc3de88a69429a8e5fc1ae395f2
PE Executable
MD5: 216f1fc3de88a69429a8e5fc1ae395f2
Size: 1.16 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Encoded VBScript file
Size
1.16 MB · 1,164,942 B
First seen
2026-08-17 00:46 · 2 months ago
Last seen
2026-08-17 00:46 · 2 months ago
Last analysis
2026-08-17 00:46 · 2 months ago
Hashes
MD5
216f1fc3de88a69429a8e5fc1ae395f2
Sha1
0181b7f198bcccd9a70628c4b43e6a442ef04f09
Sha256
57d4d81d179f20dce45e01c06873b803ca8af17ffb3109f471dd54d50e1afb7f
Sha384
85da321aa585455f5774a9fde3a078923b9c09ff74c8fe69ddc924c2b1f38ec2096e1ceb0609bea8879343574df85348
Sha512
d18e5488add336aa78d555c65290684fb72a978887385202e79223e9d9a926a5de851ced9d0889e4b9c45156f106e084433fe0b290d5fe8c94ab555b0352536c
SSDeep
24576:U2G/nvxW3Ww0t0cl+qUNC9iIg8tHdUMoTOjE0imVdiZbddEv4:UbA300o+K99wqipUA
TLSH
7C4549017E44CE12F0191633C2EF4A4847B4AC50AAA6E72B7EF9376E55123937C1DADB
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
4 malicious · 34 files
EXE216f1fc3de88a69429a8e5fc1ae395f2T1059.005
Structure
VBSOverlay_4805e517.bin
BAT3sJ5LW4XsnRdoCZ2JPktvg68.bat
EXEProviderDll.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BIN.Net Resources
BINScqbEla0eBrcGigTCc.X6VIguQugc9t8A8m7l
BINemHGbLRxFXk2fbZV1N.D7R9VgFFLvDBtggwVc
VBSGzGKoQlvkp9TE41eMtGat0fPEoZbt.vbe
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
VBS216f1fc3de88a69429a8e5fc1ae395f2.decoded.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
7 / 7
Path
pe:exe>scr:vbe>pe:exe>pe:rsrc>bin
Shape
pe:exe>scr:vbe>pe:exe>pe:rsrc>bin
malicious
5 nodes
Path
pe:exe>scr:vbe>pe:exe>bin
Shape
pe:exe>scr:vbe>pe:exe>bin
malicious
4 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_4805e517.bin (848526 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |
4 malicious · 34 files
EXE216f1fc3de88a69429a8e5fc1ae395f2T1059.005
Structure
VBSOverlay_4805e517.bin
BAT3sJ5LW4XsnRdoCZ2JPktvg68.bat
EXEProviderDll.exe
Structure
BINResources
BIN.Net Resources
VBSGzGKoQlvkp9TE41eMtGat0fPEoZbt.vbe
BINResources
VBS216f1fc3de88a69429a8e5fc1ae395f2.decoded.vbsT1059.005
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account