Suspicious
Suspect

4da1b635446662e41532e125098750f0

PE Executable
MD5: 4da1b635446662e41532e125098750f0
Size: 478.21 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 4da1b635446662e41532e125098750f0
Sha1 b053deed5b793496fe22885e961aa5218163cda2
Sha256 0c342290ca4d6e0e8cd357ebf63c69436e9f8b32687fbd556d0be2e962ff2cd3
Sha384 920d37ad7a77ed5f66e59ff998bc19cc048dc7e53b2fc7785fa3895b309be9814bb3431c3d8ba531bddc134e212cfc1f
Sha512 65d9bf8fb97b1b3dcf4c39fddb5f72a552e80d2412318109dfa837c1ddfcdcb1fd170cc37056e3f35041d185261ca714bf441caf3dca5b17828648c45cab1842
SSDeep 6144:UAPRUwKzdXMl92pOAPbxSAszwUeKWf3dLmms0nDWdyKimdYDPJHT04nnBwtTTfAd:UA4RXM+OA9xKWYms0nDWMK0
TLSH 3AA429427BE4DDE6DC226138958B63189736FCB0179296DB57200222AE07BEC9D3FF15
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
Overlay_841f7d59.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.buildid
.data
.pdata
.tls
.rsrc
.reloc
4
18
30
42
53
67
Resources
RT_MANIFEST
ID:0001
ID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1059.007>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
technique3 nodes
Path pe:exe~T1059.007>bin
Shape pe:exe>bin
technique2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_841f7d59.bin (99328 bytes)
Overlay_841f7d59.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.buildid
.data
.pdata
.tls
.rsrc
.reloc
4
18
30
42
53
67
Resources
RT_MANIFEST
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙