Suspect
6c0a7f88c7e4833118de099fbbb28c05
AutoIt Compiled Script
MD5: 6c0a7f88c7e4833118de099fbbb28c05
Size: 2.04 MB
application/x-dosexec
This sample is a 1.9 MB AutoIt Compiled Script for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 73 embedded or derived files. It matches 7 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 63bbccfcd5235a91bedd2c5640d7f4528a712813062db33431811149fe2b8afe
- MD5
- 6c0a7f88c7e4833118de099fbbb28c05
- Verdict
- Inconclusive
- File type
- AutoIt Compiled Script · 1.9 MB
Cite this report: https://app.malva.re/sha256/63bbccfcd5235a91bedd2c5640d7f4528a712813062db33431811149fe2b8afe
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
AutoIt Compiled Script
Size
2.04 MB · 2,042,368 B
First seen
2026-09-24 09:45 · one month ago
Last seen
2026-09-24 09:45 · one month ago
Last analysis
2026-09-24 09:45 · one month ago
Hashes
MD5
6c0a7f88c7e4833118de099fbbb28c05
Sha1
f06ba242b8822eed0e7ce6529deb31341f14e2ca
Sha256
63bbccfcd5235a91bedd2c5640d7f4528a712813062db33431811149fe2b8afe
Sha384
a55030b519e3fdab35c509cce4342d3cc32fbd1c5b61b1b7809f651b52a15d0e3380738a098ccc01db72cf89204a89bc
Sha512
9003b9fb805ad570c705f197e1716a726b3539fb9d2121b56d9e903674eb747e8a7b77754987b5043aa02734e5389c8f98d492dcad8ce764bed85b03b3ef0087
SSDeep
49152:IU8Kmz9/JlCIrEJDPG6xJRA2GoC3d3nJz27exiCz5q6t:YzpXCIrEJSmA2tC3d3c7W7
TLSH
2095232251D4086BD0B1D674C8F3569BAA337C940B2476CF12E8988FAF736D9F436716
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)Private EXE Protector V2.30-V2.3X -> SetiSoft TeamUPolyX 0.3 -> delikon
66 files
A3X6c0a7f88c7e4833118de099fbbb28c05
Structure
BINResources
BINAVI
BINID:0BB9
BINID:1033
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
IMGID:1033
IMGID:1033-preview.png
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINRT_DIALOG
BINID:07D1
BINID:1033
BINID:07D2
BINID:1033
BINID:07D3
BINID:1033
BINID:07D4
BINID:1033
BINID:07D5
BINID:1033
BINID:07D6
BINID:1033
BINRT_STRING
BINID:003F
BINID:1033
BINID:004C
BINID:1033
BINID:004D
BINID:1033
BINID:0050
BINID:1033
BINID:0053
BINID:1033
BINID:0055
BINID:1033
BINRT_RCDATA
BINID:0000
BINID:1033
A3XAutoIt3.exe
P7B[Authenticode]_944bc61d.p7b
BINRT_GROUP_CURSOR4
BINID:0BB8
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
A3XAccurately.a3x
A3XAutoIt3.exe
Structure
P7B[Authenticode]_b506780c.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:2057
BINID:0002
BINID:2057
BINID:0003
BINID:2057
BINID:0004
BINID:2057
BINID:0005
BINID:2057
BINID:0006
BINID:2057
BINID:0007
IMGID:2057
IMGID:2057-preview.png
BINID:0008
BINID:2057
BINID:0009
BINID:2057
BINID:000A
BINID:2057
BINID:000B
BINID:2057
BINID:000C
BINID:2057
BINID:000D
BINID:2057
BINRT_MENU
BINID:00A6
BINID:2057
BINRT_DIALOG
BINID:03E8
BINID:2057
BINRT_STRING
BINID:0007
BINID:2057
BINID:0008
BINID:2057
BINID:0009
BINID:2057
BINID:000A
BINID:2057
BINID:000B
BINID:2057
BINID:000C
BINID:2057
BINID:0139
BINID:2057
BINRT_GROUP_CURSOR4
BINID:0063
BINID:2057
BINID:00A2
BINID:2057
BINID:00A4
BINID:2057
BINID:00A9
BINID:2057
BINRT_VERSION
BINID:0001
BINID:2057
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 7
STICH kept: 1secondary ignored: 6
bin
4img
2Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:autoit
Shape
pe:exe>pe:autoit
2 nodes
| Name | Value |
|---|---|
| Info | PDB Path: wextract.pdb |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential66 files
A3X6c0a7f88c7e4833118de099fbbb28c05
Structure
BINResources
A3XAccurately.a3x
A3XAutoIt3.exe
No malware configuration was found at this point.
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
6c0a7f88c7e4833118de099fbbb28c05 › Resources › RT_RCDATA › ID:0000 › ID:1033 › AutoIt3.exe
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account