Malicious
301e927cd4b68262f1c3f8f29f2c4586
AutoIt Compiled Script
MD5: 301e927cd4b68262f1c3f8f29f2c4586
Size: 20.39 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
AutoIt Compiled Script
Size
20.39 MB · 20,386,816 B
First seen
2026-07-29 13:30 · 2 months ago
Last seen
2026-07-29 13:30 · 2 months ago
Last analysis
2026-07-29 13:36 · 2 months ago
Hashes
MD5
301e927cd4b68262f1c3f8f29f2c4586
Sha1
d5f1d65724042f5c6e86c6309418efc041d3e1ab
Sha256
696329a31289fd29b81a5fcaeedec83bea3cd21aa9a721ae50650a6a1ac6c00e
Sha384
70c731531edd28714f77066aa6b68573f4461f64d688fdaa3356084e5f22f3a5a6e69e63d7f0a5097e69dba561ae4478
Sha512
ead26c8a37985bb84308f1d6dfa404329d7fd54a184239501ed79b9a6e3fd7c56b9d903d04eb30c4adbd26525485964d78511f555983024e444a19c0dd5c312a
SSDeep
98304:d7BcFS5aiA65GTK3/cAjp/hdePFPZxjIJrM0ZdgGoG2cPK85gBvlAdL:7cFSIAj9hgYJ40ZdeCKs6adL
TLSH
4227824E36028017EDA62737C5F28252AC77AD304719C4DE35907E9A5E78EDF093D3AA
Detection
PeID
Borland Delphi 2006Borland Delphi 4.0Borland Delphi v3.0Borland Delphi v3.0Borland Delphi v3.0 - v7.0Borland Delphi v6.0 - v7.0Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLMicrosoft WAV Audio filePe123 v2006.4.4-4.12RPolyCryptor V1.4.2 -> Vaska
3 malicious · 99 files
A3X301e927cd4b68262f1c3f8f29f2c4586
Structure
A3Xaut3BF.tmp.tok
A3X[Cleaned].au3
BINResources
BINVCLSTYLE
BINID:0000
BINID:1033
BINWAVE
BINID:0000
BINID:1046
BINRT_CURSOR
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINRT_STRING
BINID:0FE3
BINID:0
BINID:0FE4
BINID:0
BINID:0FE5
BINID:0
BINID:0FE6
BINID:0
BINID:0FE7
BINID:0
BINID:0FE8
BINID:0
BINID:0FE9
BINID:0
BINID:0FEA
BINID:0
BINID:0FEB
BINID:0
BINID:0FEC
BINID:0
BINID:0FED
BINID:0
BINID:0FEE
BINID:0
BINID:0FEF
BINID:0
BINID:0FF0
BINID:0
BINID:0FF1
BINID:0
BINID:0FF2
BINID:0
BINID:0FF3
BINID:0
BINID:0FF4
BINID:0
BINID:0FF5
BINID:0
BINID:0FF6
BINID:0
BINID:0FF7
BINID:0
BINID:0FF8
BINID:0
BINID:0FF9
BINID:0
BINID:0FFA
BINID:0
BINID:0FFB
BINID:0
BINID:0FFC
BINID:0
BINID:0FFD
BINID:0
BINID:0FFE
BINID:0
BINID:0FFF
BINID:0
BINID:1000
BINID:0
BINRT_RCDATA
BINID:0000
BINID:1046
Structure
IMGID:1046-preview.png
BINResources
BINRT_ICON
BINID:0001
BINID:2057
BINID:0002
BINID:2057
BINID:0003
BINID:2057
BINID:0004
BINID:2057
BINID:0005
BINID:2057
BINID:0006
BINID:2057
BINID:0007
BINID:2057
BINID:0008
BINID:2057
BINID:0009
BINID:2057
BINID:000A
BINID:2057
BINID:000B
BINID:2057
BINID:000C
BINID:2057
BINID:000D
BINID:2057
BINID:000E
BINID:2057
BINID:000F
BINID:2057
BINID:0010
BINID:2057
BINID:0011
BINID:2057
BINID:0012
BINID:2057
BINID:0013
BINID:2057
BINRT_MENU
BINID:00A6
BINID:2057
BINRT_STRING
BINID:0007
BINID:2057
BINID:0008
BINID:2057
BINID:0009
BINID:2057
BINID:000A
BINID:2057
BINID:000B
BINID:2057
BINID:000C
BINID:2057
BINID:0139
BINID:2057
BINRT_RCDATA
BINID:0000
A3XID:0
BINRT_GROUP_CURSOR4
BINID:0063
BINID:2057
BINID:00A2
BINID:2057
BINID:00A4
BINID:2057
BINID:00A9
BINID:2057
BINRT_VERSION
BINID:0001
BINID:2057
BINRT_MANIFEST
BINID:0001
BINID:2057
BINID:1033
IMGID:1033-preview.png
BINID:0
BINRT_GROUP_CURSOR2
BINID:0000
BINID:1033
BINID:7FF9
BINID:1033
BINID:7FFA
BINID:1033
BINID:7FFB
BINID:1033
BINID:7FFC
BINID:1033
BINID:7FFD
BINID:1033
BINID:7FFE
BINID:1033
BINID:7FFF
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 5
STICH kept: 2secondary ignored: 3
bin
2img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:dll>pe:autoit
Shape
pe:dll>pe:autoit
malicious
2 nodes
Path
pe:dll>pe:rsrc>pe:exe>pe:rsrc>pe:autoit
Shape
pe:dll>pe:rsrc>pe:exe>pe:rsrc>pe:autoit
5 nodes
3 malicious · 99 files
A3X301e927cd4b68262f1c3f8f29f2c4586
Structure
A3Xaut3BF.tmp.tok
A3X[Cleaned].au3
BINResources
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account