6c221453aa44b425351a3981f1239267

PE Executable

MD5: 6c221453aa44b425351a3981f1239267

Size: 7.14 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	6c221453aa44b425351a3981f1239267
Sha1	d1728ae8419c4b78dd2fdb49675a2e4f15d3eaf6
Sha256	4ef9958a07791b8dd453998adf8a1eb443127bd63ae77f4f3b448ef5d5fd6b40
Sha384	2e952f837e73d40acab80e66b84e72f1153e9a81a052fec8a198dbff9602782215197f2533369e91b1d9d724d05ba4b0
Sha512	29985fbe4005460320a8956b6ed27e4b0eac8185950c099eb92831bcc108b647fa3f26012d434e891dfc832bb05557470360a9b3abe7a10baa03c40131346a9b
SSDeep	98304:tzIus6efPXIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:thfefPkHxcp9ym3nltDUJV
TLSH	DD760100B3E1D9B6C57F163CD83A86B56A35BD008356DEBF4385B9691E32B804E337A5

PeID

Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12VC8 -> Microsoft Corporation

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 19 STICH kept: 3secondary ignored: 16

bin 15img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>pe:exe>ole:doc>scr:ps1~T1027~T1059.001

Shape pe:exe>pe:rsrc>pe:exe>ole:doc>scr:ps1

malicious 5 nodes

Path pe:exe>pe:rsrc>pe:exe>ole:doc>pe:dll

Shape pe:exe>pe:rsrc>pe:exe>ole:doc>pe:dll

5 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x6B8AE8 size 94024 bytes
Info	PDB Path: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

6c221453aa44b425351a3981f1239267 › Resources › FILES › ID:0000 › ID:0 › .Net Resources › ScreenConnect.ScreenConnect.ClientSetup.msi › ScreenConnect.Core.dll

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.