Malicious
33db06a6f2ebf29eb8750c9c6e7cd8af
PE Executable
MD5: 33db06a6f2ebf29eb8750c9c6e7cd8af
Size: 351.62 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
351.62 KB · 351,621 B
First seen
2026-10-23 13:30 · 2 days ago
Last seen
2026-10-23 13:30 · 2 days ago
Last analysis
2026-10-23 13:30 · 2 days ago
Hashes
MD5
33db06a6f2ebf29eb8750c9c6e7cd8af
Sha1
9eb744082f1e352656652db88fdfa02a7ca37271
Sha256
1e678e7e10ffe96f9a10feef547ababb34e3b38b74d64bcb7d52486f3dbd961c
Sha384
c3ef7134d68df6408278f810a5cecd4c42da38faf74594933ba6388bfc896648f931ea51bdfa3f38b5ee023d0474233a
Sha512
ab530c163e3578070a05f2500004d2bbae590fd0eeeb316068ee50a8a04b8c9d2e8be7146eb179b756ed316cf6944f63622f42568bee3431302345488d5f6725
SSDeep
6144:5TouKrWBEu3/Z2lpGDHU3ykJYYEAmg+5D/kf:5ToPWBv/cpGrU3yhYEAmD5zkf
TLSH
2E749F52BAC2C8B1D4631A721935A720543D7E241FB5C98F73D43E2FFA722C1A631B66
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
5 malicious · 23 files
EXE33db06a6f2ebf29eb8750c9c6e7cd8afT1027 · T1105 · T1059.001
Structure
RAROverlay_c8d3216a.binT1027 · T1105 · T1059.001
JSPO-2CT475H-658657GE90.jsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1024
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1024
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 3
STICH kept: 1secondary ignored: 2
bin
1img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>arc:rar>scr:js~T1059.007>scr:ps1~T1027~T1059.001~T1105
Shape
pe:exe>arc:rar>scr:js>scr:ps1
malicious
4 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_c8d3216a.bin (1413 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential5 malicious · 23 files
EXE33db06a6f2ebf29eb8750c9c6e7cd8afT1027 · T1105 · T1059.001
Structure
RAROverlay_c8d3216a.binT1027 · T1105 · T1059.001
JSPO-2CT475H-658657GE90.jsT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
BINResources
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
33db06a6f2ebf29eb8750c9c6e7cd8af › Overlay_c8d3216a.bin › PO-2CT475H-658657GE90.js › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account