Malicious
Malicious

250df0e912b813ee97bf1408bda36823

Share on LinkedIn
Print
VBScript Encoded
MD5: 250df0e912b813ee97bf1408bda36823
Size: 1.17 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 250df0e912b813ee97bf1408bda36823
Sha1 e49f1840c24ae911caab350feb70345e7ace99e0
Sha256 10ff3c82edf92620726c77b368918b64f0744c2cf3cb422279d43cb539fa5cec
Sha384 f30a3f977f3948b8e44556a39756cee798c1a31fe567a22bf5861559188ca26aad8467a67c2e011e456b14ddee61cc0b
Sha512 9c933325147465a71950f634c18a922cc38ff9d228525a5dd86f03382bf24a0dd29acf538910a6b24cb9d0879f5dad1d8cf7161daf5c1cdb43622a1dd1c59ebe
SSDeep 24576:U2G/nvxW3Ww0tzIiNStY03xyY+F6hrR55KghwZKGEyIX:UbA30zIi4QY+kr5KghrZP
TLSH E34549017E84CE12F0191633C6EF494487B4AC512AB6E72B7EB9376E55223937C1DACB
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
N5wXzXqrgI1GIYBj1a0kAfIMVJ2V9.bat
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
bdnSsrKgLc1iVTZceZ.VNEtGXmXGn647FGEJl
FTki8pwSlTi0kyL3QC.X97DgbcltGGXlim7o5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.didat
.rsrc
.reloc
Resources
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_DIALOG
ID:0000
ID:1033
RT_STRING
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_MANIFEST
ID:0001
ID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
7 / 7
Path pe:exe>arc:rar>pe:exe>pe:rsrc>bin
Shape pe:exe>arc:rar>pe:exe>pe:rsrc>bin
malicious 5 nodes
Path pe:exe>arc:rar>pe:exe>bin
Shape pe:exe>arc:rar>pe:exe>bin
malicious 4 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_8d0db700.bin (849032 bytes)
Info
PDB Path: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Command (COM trace) #1 UNKNWOWNmalicious
C:/blohuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙