Malicious
PE Executable
MD5: 33f9988ad3a9c08af73fceb0779ca7eb
Size: 3.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
3.59 MB · 3,592,859 B
Hashes
MD5
33f9988ad3a9c08af73fceb0779ca7eb
Sha1
7c9c6cf9c61c113f530fd993e1703897d8c0790c
Sha256
12784917afb2b0f5adafb44b94c3ef3019ccf6a991fcfe9033415bb45a5d931c
Sha384
d17470afbfd4ffa5e816d567332786f3f05f1ac91dadd2ad8e626cf7b4e691518e9889b68c7e1b617f95770d1880a0ab
Sha512
f9febce855e8eaaa45e75fb2f64a6446ec3b3e0b2c73a15c5ae6ee655fcae90c4cb8f7b715ac0c202bd440582259ee24d488ec4425822488a6feb9399ec7d5e6
SSDeep
98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4Oc:iJiafuIO7rhWEES41
TLSH
F7F5335BF5AB47B3F7D9A831560FC66458B09FE40A20D38AD4DBAA9F0886FD0C241375
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser
2 malicious · 3 files
EXE33f9988ad3a9c08af73fceb0779ca7ebT1027 · T1055Go Loader (Factory-v3)
Structure
EXE[UPX unpacked Lzma].exeT1027 · T1055Go Loader (Factory-v3)
Structure
BINOverlay_25371476.bin
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| UPX | UPX method: Lzma, filter: X86CallJumpBe |
| UPX | UPX unpacking confidence: 0.99 |
| UPX | |
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_25371476.bin (155 bytes) |