Deep Malware Analysis of 37856661aa5bb1d595690d1658c9d769 | md5: 37856661aa5bb1d595690d1658c9d769 | Executable | PE (Portable Executable) | AutoIt | CAB:COMPRESSION:LZX | PE File Layout | Win 64 Exe | x64 | PDB Path | Suspect | Decompiled

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	37856661aa5bb1d595690d1658c9d769
Sha1	7e1ebcb66c94e797b14af5f03899a5aaafcb65ec
Sha256	d12968c99af8b54320593d5574e160856112c442ec7a39fb55672f3849bddb87
Sha384	df79ec5b909a5e76683edc6f9ebd4c0d9d6d4628f9e94674139a676b338b3670ab3e8b07f72ed77aa92c31fc743f46d6
Sha512	466852fa29a3df37873988eca50d951449b93445ddc7d0348fa477248161010fb9b7dbe0720659f0a7567786d9c18c538573179093d9a20c59e282044a94ebe3
SSDeep	98304:u+GxodUQpjuGylB73joGyZ/2ydqJwx0j135ETH/LQnw2/afZB9Acx:MxoSQpihB7T8uyqJwx0j1iTHzRFx
TLSH	964633630BF84D87D0BC0F714CD145A26211B893463EBA1BAB57ED957C239E6D97830B

PeID

Microsoft Visual C++ 8.0 (DLL)UPolyX 0.3 -> delikon

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5

bin 3img 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:autoit>pe:autoit

Shape pe:exe>pe:autoit>pe:autoit

malicious 3 nodes

Path pe:exe>pe:rsrc>pe:autoit

Shape pe:exe>pe:rsrc>pe:autoit

3 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: wextract.pdb