Malicious
PE Executable
MD5: 3af7c7886dbc92faad9b46ca4a0e2bdb
Size: 37.89 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score
Low
| MD5 | 3af7c7886dbc92faad9b46ca4a0e2bdb |
| Sha1 | 5f4d777b4cf2e07eff0c33f54541c617b238fb68 |
| Sha256 | 3464447f8b816cfb5d61575cf343971394e5f4834adb2b7d3964c305dbb18182 |
| Sha384 | e4efb9a78956eb023af3553476f173fd6ab64ac2334fafb0a7e2176cd37922d0a3050fb2c08c21adc1de826d28b86aa2 |
| Sha512 | 565e59526612ee76e859967d71678934b3555cae76d1947832bd4075340b20290674c6291c7b4016a16cde9bec2098085865db88f592a50e8bc139d8fc26b580 |
| SSDeep | 384:a0r9UiFCbK7FmpE8QyEfF8e/VKfnuIWrAF+rMRTyN/0L+EcoinblneHQM3epzXEO:9g2n8LEfSe4vuvrM+rMRa8Nuiat |
| TLSH | 5E032A4D7FE18168C5FD097B05B2D41207BAE04B6E23D91E8EF564EA37636C18B50AF2 |
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | serhuhuhuhu |
| cnc_host [HH] | 2.5huhuhuhu |
| is_dir_defined [Idr] | Thuhuhuhu |
| is_startup_folder [IsF] | Thuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| NH [NH] | 0huhuhuhu |
| cnc_port [P] | 4huhuhuhu |
| reg_key [RG] | 55faadhuhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| sizk | 2huhuhuhu |
| victim_name [VN] | 6huhuhuhu |
| version [VR] | ihuhuhuhu |
| splitter [Y] | |huhuhuhu |
| HD | Thuhuhuhu |
| anti [anti] | Exsahuhuhuhu |
| anti2 [anti2] | Fhuhuhuhu |
| usb [usb] | Fhuhuhuhu |
| usbx [usbx] | svchuhuhuhu |
| task [task] | Thuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Module Name | w.exe |
| Full Name | w.exe |
| EntryPoint | System.Void w.A::main() |
| Scope Name | w.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | w |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 338 |
| Main Method | System.Void w.A::main() |
| Main IL Instruction Count | 5 |
| Main IL | |
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | w.exe |
| Full Name | w.exe |
| EntryPoint | System.Void w.A::main() |
| Scope Name | w.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | w |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 338 |
| Main Method | System.Void w.A::main() |
| Main IL Instruction Count | 5 |
| Main IL | |
Port
PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential