Malicious
Disk Image
MD5: 40f747b537eb469e2d106ec2e8bf4860
Size: 23.8 MB
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Disk image
Size
23.8 MB · 23,797,760 B
Hashes
MD5
40f747b537eb469e2d106ec2e8bf4860
Sha1
8773a14a80f23ec6ce9c5eae72480e7c18d8daf3
Sha256
8b88b5ce9263f49cbc0a2f05d754a75a860e970ceb9eb416cb767595a1d2451b
Sha384
9203d44c8eb0c0f619dc5780a179e81fdf02295ee33b63479f3813d848004c8a20266379d63200045a5a3d3b834f6d76
Sha512
746ec7357d8e2178ac474d7c597f17298230c9ab1e77e4429bc144f5ee38fcc48d23abda8e048f75cd0986b381501777bcc36362d5764b043ea28df46d2abbd7
SSDeep
393216:boJesJnkfBTky1b4UyhT/evPMRL31CPwDvt3uFhCkcFe9Xbp8kY3ucN6OyVBlH:2efBTky1DEBNuc8lr
TLSH
0D37BE16B2988199D467907CC853865BE3B2BC25AB6183DF30A6B32D1F337D12B7E354
3 malicious · 712 files
ISO40f747b537eb469e2d106ec2e8bf4860T1059.005
EXEAdobe Installer.exe
TXTLICENSE.txt
_PTHpython312._pth
DLLpython312.dll
DLLvcruntime140.dll
DLLvcruntime140_1.dll
BINlib
EXE_asyncio.pyd
EXE_bz2.pyd
EXE_ctypes.pyd
EXE_decimal.pyd
EXE_elementtree.pyd
EXE_hashlib.pyd
EXE_lzma.pyd
EXE_msi.pyd
EXE_multiprocessing.pyd
EXE_overlapped.pyd
EXE_queue.pyd
EXE_socket.pyd
EXE_sqlite3.pyd
EXE_ssl.pyd
EXE_uuid.pyd
EXE_wmi.pyd
EXE_zoneinfo.pyd
DATblind_engine.dat
DATcore.dat
DLLlibcrypto-3.dll
DLLlibffi-8.dll
DLLlibssl-3.dll
EXEpyexpat.pyd
CATpython.cat
DLLpython3.dll
ZIPpython312.zipT1059.005
PYCabc.pyc
PYCaifc.pyc
PYCantigravity.pyc
PYCargparse.pyc
PYCast.pyc
PYCbase64.pyc
PYCbdb.pyc
PYCbisect.pyc
PYCbz2.pyc
PYCcalendar.pyc
PYCcgi.pyc
PYCcgitb.pyc
PYCchunk.pyc
PYCcmd.pyc
PYCcode.pyc
PYCcodecs.pyc
PYCcodeop.pyc
PYCcolorsys.pyc
PYCcompileall.pyc
PYCconfigparser.pyc
PYCcontextlib.pyc
PYCcontextvars.pyc
PYCcopy.pyc
PYCcopyreg.pyc
PYCcProfile.pyc
PYCcrypt.pyc
PYCcsv.pyc
PYCdataclasses.pyc
PYCdatetime.pyc
PYCdecimal.pyc
PYCdifflib.pyc
PYCdis.pyc
PYCdoctest.pyc
PYCenum.pyc
PYCfilecmp.pyc
PYCfileinput.pyc
PYCfnmatch.pyc
PYCfractions.pyc
PYCftplib.pyc
PYCfunctools.pyc
PYCgenericpath.pyc
PYCgetopt.pyc
PYCgetpass.pyc
PYCgettext.pyc
PYCglob.pyc
PYCgraphlib.pyc
PYCgzip.pyc
PYChashlib.pyc
PYCheapq.pyc
PYChmac.pyc
PYCimaplib.pyc
PYCimghdr.pyc
PYCinspect.pyc
PYCio.pyc
PYCipaddress.pyc
PYCkeyword.pyc
PYClinecache.pyc
PYClocale.pyc
PYClzma.pyc
PYCmailbox.pyc
PYCmailcap.pyc
PYCmimetypes.pyc
PYCmodulefinder.pyc
PYCnetrc.pyc
PYCnntplib.pyc
PYCntpath.pyc
PYCnturl2path.pyc
PYCnumbers.pyc
PYCopcode.pyc
PYCoperator.pyc
PYCoptparse.pyc
PYCos.pyc
PYCpathlib.pyc
PYCpdb.pyc
PYCpickle.pyc
PYCpickletools.pyc
PYCpipes.pyc
PYCpkgutil.pyc
PYCplatform.pyc
PYCplistlib.pyc
PYCpoplib.pyc
PYCposixpath.pyc
PYCpprint.pyc
PYCprofile.pyc
PYCpstats.pyc
PYCpty.pyc
PYCpyclbr.pyc
PYCpydoc.pyc
PYCpy_compile.pyc
PYCqueue.pyc
PYCquopri.pyc
PYCrandom.pyc
PYCreprlib.pyc
PYCrlcompleter.pyc
PYCrunpy.pyc
PYCsched.pyc
PYCsecrets.pyc
PYCselectors.pyc
PYCshelve.pyc
PYCshlex.pyc
PYCshutil.pyc
PYCsignal.pyc
PYCsite.pyc
PYCsmtplib.pyc
PYCsndhdr.pyc
PYCsocket.pyc
PYCsocketserver.pyc
PYCsre_compile.pyc
PYCsre_constants.pyc
PYCsre_parse.pyc
PYCssl.pyc
PYCstat.pyc
PYCstatistics.pyc
PYCstring.pyc
PYCstringprep.pyc
PYCstruct.pyc
PYCsubprocess.pyc
PYCsunau.pyc
PYCsymtable.pyc
PYCsysconfig.pyc
PYCtabnanny.pyc
PYCtarfile.pyc
PYCtelnetlib.pyc
PYCtempfile.pyc
PYCtextwrap.pyc
PYCthis.pyc
PYCthreading.pyc
PYCtimeit.pyc
PYCtoken.pyc
PYCtokenize.pyc
PYCtrace.pyc
PYCtraceback.pyc
PYCtracemalloc.pyc
PYCtty.pyc
PYCtypes.pyc
PYCtyping.pyc
PYCuu.pyc
PYCuuid.pyc
PYCwarnings.pyc
PYCwave.pyc
PYCweakref.pyc
PYCwebbrowser.pyc
PYCxdrlib.pyc
PYCzipapp.pyc
PYCzipimport.pyc
PYC_aix_support.pyc
PYC_collections_abc.pyc
PYC_compat_pickle.pyc
PYC_compression.pyc
PYC_markupbase.pyc
PYC_osx_support.pyc
PYC_pydatetime.pyc
PYC_pydecimal.pyc
PYC_pyio.pyc
PYC_pylong.pyc
PYC_py_abc.pyc
PYC_sitebuiltins.pyc
PYC_strptime.pyc
PYC_threading_local.pyc
PYC_weakrefset.pyc
PYC__future__.pyc
PYC__hello__.pyc
BINasyncio
BINcollections
BINconcurrent
BINctypes
BINcurses
BINdbm
BINemail
BINencodings
BINhtml
BINhttp
BINimportlib
BINjson
BINlib2to3
BINlogging
BINmsilib
BINmultiprocessing
BINpydoc_data
VBStopics.pycT1059.005
CSS_pydoc.css
PYC__init__.pyc
BINre
BINsite-packages
BINsqlite3
BINtomllib
BINunittest
BINurllib
BINwsgiref
BINxml
BINxmlrpc
BINzipfile
BINzoneinfo
BIN__phello__
EXEselect.pyd
PYCsitecustomize.pyc
DLLsqlite3.dll
EXEunicodedata.pyd
EXEwinsound.pyd
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 10
STICH kept: 3secondary ignored: 7
bin
6img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
img:disk>arc:zip>scr:vbs~T1059.005
Shape
img:disk>arc:zip>scr:vbs
technique3 nodes
Path
img:disk>arc:zip>html
Shape
img:disk>arc:zip>html
3 nodes
| Name | Value |
|---|---|
| ISO | DiskImage extraction mode: DiscUtils (ISO) |
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential