Deep Malware Analysis of 29fc322ceb5f47f5596018e502a3f619 | md5: 29fc322ceb5f47f5596018e502a3f619 | CAB:COMPRESSION:LZX | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | PDB Path | PowerShell | T1059.001 | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	29fc322ceb5f47f5596018e502a3f619
Sha1	25718aa0f21434181c76f8247b1cf0dd56c980ca
Sha256	6336b1a886d5b84480eade15f0c9b9fb510fe0f02a8501b5ab08229075985086
Sha384	124518f20daee5f06cfcb1875b92561bc568046fb9d7b8601be7e0ae893da8d45c854d80c5abf644727b4f61fe433d73
Sha512	d0ebb42b89b5aea6a7b581180cde6e91918696da001d0042ab9f4f193c41452341b55fd6f5a5fb9a9dac5d62c875d2cc0c802598f651521e224cf8b570228e05
SSDeep	12288:TEzPL/FzLf8SRjCGkbtsh6oGEiQo/BjlAVolFPFtUfpZs:4zPtfhjaG6JuGBmqvws
TLSH	ACD4F11553E800A6F0B66B7498B24A9799327C21AFB492FF13C4A17D1F336C5A536F0B

PeID

Microsoft Visual C++ 8.0 (DLL)

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3

bin 2img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>scr:ps1~T1027~T1059.001

Shape pe:exe>pe:rsrc>scr:ps1

malicious 3 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: wextract.pdb

Deobfuscated PowerShell UNKNWOWNmalicious

. (Gethuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential