Suspicious
Suspect

37cd426b36fc4ee517cef319cf14076f

VBScript
MD5: 37cd426b36fc4ee517cef319cf14076f
Size: 5.82 MB
text/vbscript

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 37cd426b36fc4ee517cef319cf14076f
Sha1 b26a0f4fff71202b4183619cd360a8d88dae5158
Sha256 c16ebbbebe01f0fee4eb7f658bb25770eb0601cc850d0225097c0157d12df0e7
Sha384 ba574fcf36b120743293893decba136c339b8fe5a2213c659cda534fdb824df72dac9b8915a0e08bcd09fae0297796c5
Sha512 914d083772424c107cedbb5e7fbeddb9a70fe85a536189b74444ccc469c58e7fe90816156c9d498d63130b4051aa715df510422487ebd72d71c1fb6f3287a9aa
SSDeep 98304:/m+ZqQDrTU61ENWPDKIvCFNyE3oYGbiCv:+Aq4U60WPDKI6FNB4YGeS
TLSH B8469D56A6A450ECD5BBC17CC6568617E7F2BC0503719BCF06A0A66A1F33AE12F3E710
PeID
Borland Delphi 4.0Microsoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamUPolyX 0.3 -> delikon
Overlay_dbdb4ef8.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1049
RT_RCDATA
ID:0000
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1049
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>scr:vbs
Shape pe:exe>scr:vbs
2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_dbdb4ef8.bin (5773976 bytes)
Overlay_dbdb4ef8.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1049
RT_RCDATA
ID:0000
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1049
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙