Deep Malware Analysis of 26bf5d63bc9d033cd52c263b2aa2ad1b | md5: 26bf5d63bc9d033cd52c263b2aa2ad1b | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | PDB Path | AutoIt | CAB:COMPRESSION:LZX | Suspect | Decompiled

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	26bf5d63bc9d033cd52c263b2aa2ad1b
Sha1	b0e2fe0a84bddaddddc3310511e434fa61df4ea9
Sha256	3ec59ae574589c01c611ba26289bc111c767d3ee56b1758d3df63a1600147019
Sha384	dd31f109012101f8b8fd43cb17956baa978dd3b10ec87f6b15d795075c6e11e06411f7f6f1fd23dee3cf45af6a7ceef2
Sha512	c8b4b4e3a1e655c60dbf69cff2f5d4694c1843a13ea79e5a9764b949849cacc07a2a4916739922b1ac9e5962afc61d000e06f07af7604c973070cd36ab88dbbf
SSDeep	24576:9rsRcbYKNp03n4gZWmA7OABU5CpU8xPhuyHyCH+8xc9jeYu+gXTk0kyK:9rsabNNp03FWmA7O95iUUPwULH+8Ff+5
TLSH	A96523956BD000AAD87BA3B89AF322536775BCC517F4D3CF624082A92F239C4717B746

PeID

Microsoft Visual C++ 8.0 (DLL)UPolyX 0.3 -> delikon

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 1secondary ignored: 6

bin 5img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:autoit>pe:autoit

Shape pe:exe>pe:autoit>pe:autoit

malicious 3 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x173C00 size 10424 bytes
Info	PDB Path: wextract.pdb