Malicious
Malicious

275102d202213af0f41143e551a070f7

Share on LinkedIn
Print
AutoIt Compiled Script
MD5: 275102d202213af0f41143e551a070f7
Size: 2.33 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
AutoIt Compiled Script
Size
2.33 MB · 2,332,160 B
Hashes
MD5 275102d202213af0f41143e551a070f7 Sha1 4d8ee05728299a9943f1817f49dac54cb52d8d8f Sha256 b2504aeadd83e5773c191779d131fa7f19299d9b76bed50375364be56cc17fc8 Sha384 908a2a8123bd044233c4c42a2127f25d5227a3ee0ea58aa08730e83b87cdd5c55e9b50007850437b8e2b795ab8a04d24 Sha512 dfbfdd4565ad9b3249ddbe8dda74534bf723eaf1eba7196cc7afe911552aa68b8f51e40a2dd97d28a02a58dea950e8eb9d85ff7b5f4fc0b68af4822fb25d6142 SSDeep 49152:ajJffKhIKjSw7Q8XUGlnmu434RSbHBUx2zLza+H5VSoSGuHw:H357HCzr+x2z3a8nSGq TLSH 53B513193BA95116EC615E35BDF5C9ABD6343C884E60978B72A53EFF3E31384B421388
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)
4 malicious · 67 files
A3X275102d202213af0f41143e551a070f7
Structure
A3XCement.a3x
A3Xaut6B8.tmp.tok
A3X[Cleaned].au3
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 1secondary ignored: 5
bin 4img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:autoit>pe:autoit
Shape pe:exe>pe:autoit>pe:autoit
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: wextract.pdb
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙