Suspicious
Suspect

AutoIt Compiled Script
MD5: 6214d3420964bc8b9cb9f9e528026dcd
Size: 10.49 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 6214d3420964bc8b9cb9f9e528026dcd
Sha1 cd78631e8be383766fdc868bf5d5db30000eedb9
Sha256 63c568fc8bf2d90692018f06463cd66aa97f439610e568965e15dc063da15b0e
Sha384 f843cfc6e0b25c28f876066ab289c52e909901a8f83648d1d980df5c451277644b2df0de029edc445faa3229953b4e94
Sha512 c11216b0d735776d0ada9fdea8ca6a2d95415d64d9459ca50084c1d26777e6c1c4d29dd2b283953289117d0b91112e0e410381f16b15858c63aceed20610e07b
SSDeep 24576:ZUYY8awXzWrIbb7dmDpF0TIa6YN701Yyf7liRmnui+b2axL4fWB3qy8VOUBZrp6F:qg17TGFOIPQ7IpfpQPp4eMy8VOnoQv
TLSH B5B688C29B32341993AF1AB39FA5A8FF91E1A44676F131F9E9025146067B30417F27E3
PeID
Microsoft Visual C++ 8
Overlay_c20e91b9.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
AVI
ID:0BB9
ID:1033
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
RT_DIALOG
ID:0069
ID:1033
ID:006A
ID:1033
ID:006F
ID:1033
ID:00CD
ID:1033
ID:00CE
ID:1033
ID:00D3
ID:1033
ID:0131
ID:1033
ID:0132
ID:1033
ID:0137
ID:1033
ID:0195
ID:1033
ID:0196
ID:1033
ID:019B
ID:1033
ID:01F9
ID:1033
ID:01FA
ID:1033
ID:01FF
ID:1033
ID:025D
ID:1033
ID:025E
ID:1033
ID:0263
ID:1033
RT_STRING
ID:003F
ID:1033
ID:004C
ID:1033
ID:004D
ID:1033
ID:0050
ID:1033
ID:0053
ID:1033
ID:0055
ID:1033
RT_RCDATA
ID:0000
ID:1033
RT_GROUP_CURSOR4
ID:0BB8
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Specialized.mp3
Elite.mp3
Coffee.mp3
Banned.mp3
Postcards
Hotelscom
Nominated
Historical
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_c20e91b9.bin (8833511 bytes)
Info
PDB Path: wextract.pdb
Overlay_c20e91b9.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
AVI
ID:0BB9
ID:1033
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
RT_DIALOG
ID:0069
ID:1033
ID:006A
ID:1033
ID:006F
ID:1033
ID:00CD
ID:1033
ID:00CE
ID:1033
ID:00D3
ID:1033
ID:0131
ID:1033
ID:0132
ID:1033
ID:0137
ID:1033
ID:0195
ID:1033
ID:0196
ID:1033
ID:019B
ID:1033
ID:01F9
ID:1033
ID:01FA
ID:1033
ID:01FF
ID:1033
ID:025D
ID:1033
ID:025E
ID:1033
ID:0263
ID:1033
RT_STRING
ID:003F
ID:1033
ID:004C
ID:1033
ID:004D
ID:1033
ID:0050
ID:1033
ID:0053
ID:1033
ID:0055
ID:1033
RT_RCDATA
ID:0000
ID:1033
RT_GROUP_CURSOR4
ID:0BB8
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Specialized.mp3
Elite.mp3
Coffee.mp3
Banned.mp3
Postcards
Hotelscom
Nominated
Historical
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙