4fb617dae060628f8422f9235cf45b9a

ZIP Archive

MD5: 4fb617dae060628f8422f9235cf45b9a

Size: 278 B

application/zip

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	4fb617dae060628f8422f9235cf45b9a
Sha1	8c1c470972c19e9beccdb786e779b52dc36f4660
Sha256	a68df54861299b0771520e78883e132f0f58a8e2541b3dbb6cfc62e08f480fcb
Sha384	38ac1532312757940ad18a9ed3d0a219a668c1742baefa14c758c5078b9258df752468ef51641a900ff66a1c44e700d2
Sha512	42ec684d42745e622b1a5a1ea41eefda508621689792cf2005af0a5d9efb42361ba06ad734141665e0f1d24983ace421844d40013be08b49124f31c27002cb74
SSDeep	6:5jubN8P+LpoM/p0O95S9S5Dv65EEmcsjut7t+lM:5jubN8epoMRR9J6a3/ytJaM
TLSH	FDD02E13A222208BC70152B9D8B30E002AA9A4D8C1CAAD2B182C02C5FCA18848E8FF04

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>scr:vbs~T1027~T1059~T1059.005

Shape arc:zip>scr:vbs

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

msihuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

msihuhuhuhu

4fb617dae060628f8422f9235cf45b9a › DocuSignReader.vbs

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

4fb617dae060628f8422f9235cf45b9a › DocuSignReader.vbs

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

4fb617dae060628f8422f9235cf45b9a › DocuSignReader.vbs

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.