Suspicious
Suspect

449452a5a324ed1704ff4dbd5698d477

ZIP Archive
MD5: 449452a5a324ed1704ff4dbd5698d477
Size: 492.54 KB
application/zip

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 449452a5a324ed1704ff4dbd5698d477
Sha1 4d19aad0b3cb2dd0cd61e5ec68ada23733f6af1e
Sha256 590d4e1dccf94bc306a5fc94ad202a3c0e40ecea5c4d294f27650ed233c206b3
Sha384 e031ef456e6f957012a7880452adaebef006406e1b02d23afaa5711e70e4676f3664f8012a98bdaafb4f96e2f83e7ad8
Sha512 cfe9e949bb920acdc38234dad327841e96c5907a2837ecc2d5a3c126a7bf7f5787b77e8cdbc39da36ba684e7d0c8672e6b2565038b06578e1d61c17c4e186485
SSDeep 12288:msS5lyFd6B+6sVXkvgSe5y/qr++rVOje+yH5K:msgxI6sSvPyy+6eTH5K
TLSH 84A42397E39996EC88C47ABA8B2C0D08B27CE7745CCF06A8537E5335D1688A29E0751D
Launcher.bat
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
proto.txt
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:dll
Shape arc:zip>pe:dll
2 nodes
Path arc:zip>pe:exe
Shape arc:zip>pe:exe
2 nodes
Launcher.bat
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
proto.txt
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙