Malicious
ZIP Archive
MD5: 46106561962c79d6cfbc597f630ff9aa
Size: 20.23 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 46106561962c79d6cfbc597f630ff9aa |
| Sha1 | 1592e5fe3881646b3bbda9079b3f7bb327d66762 |
| Sha256 | b999fba4d4db5bdbfa86d6744ba53b4473f37b53d0fe74c47f7c8238350a11d8 |
| Sha384 | 02adac0afc0c9a2ad114268179e9e5ab747428014bc9f406ae096e18310c6f656bbb52e0ae7135ce0905f6d658d560ee |
| Sha512 | 629afae2f0bf9be5cd3c4ab8970a3447e3276df4a7a366490066d86ab968990638d0490a71f104baa3c83fd728feab0a57a8721b411cfa6fedcb101dc637ec0a |
| SSDeep | 393216:4voJYOm4PaJBjPvwL4835pf/9vV0LCqUMMeEHjtWehhfkiI7UXFDxiOk:4voJd5EtgL445ptvV0+sMLEgh9I7m6Ok |
| TLSH | 181723BCB4B5B95AF5D4433BC6C12CB2DB2CA540D7D93D9B8E2041927EC320E5F6A861 |
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 26
STICH kept: 26
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
26 / 26
Path
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious
6 nodes
Path
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | http:/huhuhuhuhuhuhu |
| URL #8 | http:/huhuhuhuhuhuhu |
| URL #9 | http:/huhuhuhuhuhuhu |
| URL #10 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | http:/huhuhuhuhuhuhu |
| URL #13 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #16 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #17 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #18 | http:/huhuhuhuhuhuhu |
| URL #19 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #8 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #9 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #10 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #13 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #16 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #17 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #18 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #19 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #20 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #21 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #22 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #23 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #8 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #9 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #10 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #13 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #16 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #17 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #18 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #19 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #20 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #21 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #22 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #23 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #24 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #25 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.7 |
| CreationDate | D:20201128161048 |
| Creator | http://www.helpandmanual.com |
| ModifiedDate | D:20210218152739+03'00' |
| Title | F-Rename - Hilfesystem |
| Producer | wPDF3 by WPCubed GmbH |
| /CreationDate | D:20201128161048 |
| /Creator | http://www.helpandmanual.com |
| /ModDate | D:20210218152739+03'00' |
| /Producer | wPDF3 by WPCubed GmbH |
| /Title | F-Rename - Hilfesystem |
| Version | 1.2 |
| CreationDate | D:20260423010135 |
| Creator | http://www.helpandmanual.com |
| ModifiedDate | D:20260423010135 |
| Title | F-Rename - Hilfesystem |
| Producer | wPDF3 by WPCubed GmbH |
| /Creator | http://www.helpandmanual.com |
| /Title | F-Rename - Hilfesystem |
| /CreationDate | D:20260423010135 |
| /ModDate | D:20260423010135 |
| /Producer | wPDF3 by WPCubed GmbH |
| Version | 1.2 |
| CreationDate | D:20260423010058 |
| Creator | http://www.helpandmanual.com |
| ModifiedDate | D:20260423010058 |
| Title | F-Rename - Hilfesystem |
| Producer | wPDF3 by WPCubed GmbH |
| /Creator | http://www.helpandmanual.com |
| /Title | F-Rename - Hilfesystem |
| /CreationDate | D:20260423010058 |
| /ModDate | D:20260423010058 |
| /Producer | wPDF3 by WPCubed GmbH |
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential