Malicious
707e66ca5b348be7fdcc29579394f893
Rar Archive
MD5: 707e66ca5b348be7fdcc29579394f893
Size: 2.9 KB
application/vnd.rar
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Rar archive
Size
2.9 KB · 2,899 B
First seen
2026-07-24 12:31 · 3 months ago
Last seen
2026-07-24 12:31 · 3 months ago
Last analysis
2026-07-26 15:28 · 3 months ago
Hashes
MD5
707e66ca5b348be7fdcc29579394f893
Sha1
f8b787f90c8f0965371210bd929236e1753a20d5
Sha256
3ce4fa376ce828214a8f2740d3c3f548fea46676ec8652ff8ee960036500183b
Sha384
f7e34eda9439dc022959e85a1609cddf1285f5d1881e34bb72e7e2c47cfb6ed69ec0b04d564ae760855234ab09b1150b
Sha512
ebc4bad15242f21a081b456e592df73b614bebb4c2d15cf8615c6a03e982438c35b1d8e44c96caccfeeb5656fd2522156eabc3e6d4d1b10bd77f78dd66f32161
SSDeep
48:xl6NuzOQcYhtrrj47X6h3dKhim7LZehQuFTGDb2yYL0WQCOaKrv95aEZpC3:x4NbYht4KlITXZehQDDtlRaK55aL
TLSH
F2514D71735E9216FC864DB15642E14883425436E0B3521B7E2819D1F4A89A6187F423
12 malicious · 13 files
RAR707e66ca5b348be7fdcc29579394f893T1027 · T1059.001 · T1059.005
VBSRFQ 67646.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BINRFQ 67646.vbs.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
SH[Command #1] T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
arc:rar>scr:vbs~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
arc:rar>scr:vbs>scr:bat>scr:ps1
malicious
4 nodes
Path
arc:rar>scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
arc:rar>scr:vbs>scr:bat>scr:ps1
malicious
4 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential12 malicious · 13 files
RAR707e66ca5b348be7fdcc29579394f893T1027 · T1059.001 · T1059.005
VBSRFQ 67646.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BINRFQ 67646.vbs.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
SH[Command #1] T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
707e66ca5b348be7fdcc29579394f893 › RFQ 67646.vbs › RFQ 67646.vbs.deobfuscated.vbs › [Command #1]
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
707e66ca5b348be7fdcc29579394f893 › RFQ 67646.vbs › RFQ 67646.vbs.deobfuscated.vbs › [Command #1] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
707e66ca5b348be7fdcc29579394f893 › RFQ 67646.vbs › RFQ 67646.vbs.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account