Malicious
Malicious

7268001f887c5a6290642a0dcf8a4529

MS Office Document
MD5: 7268001f887c5a6290642a0dcf8a4529
Size: 11.83 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
11.83 MB · 11,829,248 B
First seen
2026-08-25 16:15 · 2 months ago
Last seen
2026-08-25 16:15 · 2 months ago
Last analysis
2026-08-25 16:15 · 2 months ago
Hashes
MD5 7268001f887c5a6290642a0dcf8a4529 Sha1 90c75e290688ce34851d022d72e27387621a2ba2 Sha256 151d2a7f52f047638ca8ad80c859c6bfe04d7510fb10933817fa0e3ba5d07a11 Sha384 93d9af969475e99febe30a2fda25aa2c6b92468a1c14db408e2bd9c5c5f8030563d0bb1676ab8eb0fab4ab2f133f893a Sha512 b358a30262744ec8272e911822968284b87c5dbcabf559b691cce95da28077e0f014d662cd421fe0d6e56fb38925898cd063d23d90b2436e0bb4eb9fbe6660c7 SSDeep 196608:sGEiJyWvueF5uD3XxHszrwzHIZmkxYpLbOxuMLmtRbzIVp0FfFsQOJGSjWjK6884:hEpWvueFQszrwzumoqPOsR3kglF1jbKX TLSH 06C63332F2AA8E35C92D703A9DE2D494C86C3E31135490B1FB6D39E13CFC5B6A5C15A9
10 malicious · 731 files
OFF7268001f887c5a6290642a0dcf8a4529
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䕳䇲䆸䞷䄦䠥
ZIPArchive
BINfl
BINang
EXE_asyncio.pyd
Structure
P7B[Authenticode]_e59f65eb.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_bz2.pyd
Structure
P7B[Authenticode]_9295d3a4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_ctypes.pyd
Structure
P7B[Authenticode]_d2a2a08d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_decimal.pyd
Structure
P7B[Authenticode]_94d1c42d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_elementtree.pyd
Structure
P7B[Authenticode]_0333062d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_hashlib.pyd
Structure
P7B[Authenticode]_318e0f64.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_lzma.pyd
Structure
P7B[Authenticode]_12ad64c4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_multiprocessing.pyd
Structure
P7B[Authenticode]_9bb9e49c.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_overlapped.pyd
Structure
P7B[Authenticode]_e76a7b07.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_queue.pyd
Structure
P7B[Authenticode]_b5dc8776.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_remote_debugging.pyd
Structure
P7B[Authenticode]_3f492e8b.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_socket.pyd
Structure
P7B[Authenticode]_241539f8.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_sqlite3.pyd
Structure
P7B[Authenticode]_98f152c6.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_ssl.pyd
Structure
P7B[Authenticode]_24efe854.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_uuid.pyd
Structure
P7B[Authenticode]_579b61c9.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_wmi.pyd
Structure
P7B[Authenticode]_9e62ed3c.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_zoneinfo.pyd
Structure
P7B[Authenticode]_86bf200a.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_zstd.pyd
Structure
P7B[Authenticode]_d598b09e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibcrypto-3.dll
Structure
P7B[Authenticode]_5bb0b264.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibffi-8.dll
Structure
P7B[Authenticode]_398cf2a2.p7b
DLLlibssl-3.dll
Structure
P7B[Authenticode]_ff4b3538.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
TXTLICENSE.txt
DLLmsvcp150.dll
Structure
DLLmsvcp160.dll
Structure
BINResources
BINRT_MANIFEST
BINID:0002
BINID:1033
EXEpyexpat.pyd
Structure
P7B[Authenticode]_6b95cafb.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
CATpython.cat
EXEpython.exe
Structure
P7B[Authenticode]_b9cdcce6.p7b
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLpython3.dll
Structure
P7B[Authenticode]_a91096e0.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
_PTHpython314._pth
VBSpython314.dll
Structure
P7B[Authenticode]_b0d99175.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
ZIPpython314.zip
PYCabc.pyc
PYCannotationlib.pyc
PYCantigravity.pyc
PYCargparse.pyc
PYCast.pyc
PYCbase64.pyc
PYCbdb.pyc
PYCbisect.pyc
PYCbz2.pyc
PYCcalendar.pyc
PYCcmd.pyc
PYCcode.pyc
PYCcodecs.pyc
PYCcodeop.pyc
PYCcolorsys.pyc
PYCcompileall.pyc
PYCconfigparser.pyc
PYCcontextlib.pyc
PYCcontextvars.pyc
PYCcopy.pyc
PYCcopyreg.pyc
PYCcProfile.pyc
PYCcsv.pyc
PYCdataclasses.pyc
PYCdatetime.pyc
PYCdecimal.pyc
PYCdifflib.pyc
PYCdis.pyc
PYCdoctest.pyc
PYCenum.pyc
PYCfilecmp.pyc
PYCfileinput.pyc
PYCfnmatch.pyc
PYCfractions.pyc
PYCftplib.pyc
PYCfunctools.pyc
PYCgenericpath.pyc
PYCgetopt.pyc
PYCgetpass.pyc
PYCgettext.pyc
PYCglob.pyc
PYCgraphlib.pyc
PYCgzip.pyc
PYChashlib.pyc
PYCheapq.pyc
PYChmac.pyc
PYCimaplib.pyc
PYCinspect.pyc
PYCio.pyc
PYCipaddress.pyc
PYCkeyword.pyc
PYClinecache.pyc
PYClocale.pyc
PYClzma.pyc
PYCmailbox.pyc
PYCmimetypes.pyc
PYCmodulefinder.pyc
PYCnetrc.pyc
PYCntpath.pyc
PYCnturl2path.pyc
PYCnumbers.pyc
PYCopcode.pyc
PYCoperator.pyc
PYCoptparse.pyc
PYCos.pyc
PYCpdb.pyc
PYCpickle.pyc
PYCpickletools.pyc
PYCpkgutil.pyc
PYCplatform.pyc
PYCplistlib.pyc
PYCpoplib.pyc
PYCposixpath.pyc
PYCpprint.pyc
PYCprofile.pyc
PYCpstats.pyc
PYCpty.pyc
PYCpyclbr.pyc
PYCpydoc.pyc
PYCpy_compile.pyc
PYCqueue.pyc
PYCquopri.pyc
PYCrandom.pyc
PYCreprlib.pyc
PYCrlcompleter.pyc
PYCrunpy.pyc
PYCsched.pyc
PYCsecrets.pyc
PYCselectors.pyc
PYCshelve.pyc
PYCshlex.pyc
PYCshutil.pyc
PYCsignal.pyc
PYCsite.pyc
PYCsmtplib.pyc
PYCsocket.pyc
PYCsocketserver.pyc
PYCsre_compile.pyc
PYCsre_constants.pyc
PYCsre_parse.pyc
PYCssl.pyc
PYCstat.pyc
PYCstatistics.pyc
PYCstringprep.pyc
PYCstruct.pyc
PYCsubprocess.pyc
PYCsymtable.pyc
PYCtabnanny.pyc
PYCtarfile.pyc
PYCtempfile.pyc
PYCtextwrap.pyc
PYCthis.pyc
PYCthreading.pyc
PYCtimeit.pyc
PYCtoken.pyc
PYCtokenize.pyc
PYCtrace.pyc
PYCtraceback.pyc
PYCtracemalloc.pyc
PYCtty.pyc
PYCtypes.pyc
PYCtyping.pyc
PYCuuid.pyc
PYCwarnings.pyc
PYCwave.pyc
PYCweakref.pyc
PYCwebbrowser.pyc
PYCzipapp.pyc
PYCzipimport.pyc
PYC_aix_support.pyc
PYC_android_support.pyc
PYC_apple_support.pyc
PYC_ast_unparse.pyc
PYC_collections_abc.pyc
PYC_colorize.pyc
PYC_compat_pickle.pyc
PYC_ios_support.pyc
PYC_markupbase.pyc
PYC_opcode_metadata.pyc
PYC_osx_support.pyc
PYC_pydatetime.pyc
PYC_pydecimal.pyc
PYC_pyio.pyc
PYC_pylong.pyc
PYC_py_abc.pyc
PYC_py_warnings.pyc
PYC_sitebuiltins.pyc
PYC_strptime.pyc
PYC_threading_local.pyc
PYC_weakrefset.pyc
PYC__future__.pyc
PYC__hello__.pyc
BINasyncio
VBSbase_events.pyc
PYCbase_futures.pyc
PYCbase_subprocess.pyc
PYCbase_tasks.pyc
PYCconstants.pyc
PYCcoroutines.pyc
PYCevents.pyc
PYCexceptions.pyc
PYCformat_helpers.pyc
PYCfutures.pyc
PYCgraph.pyc
PYClocks.pyc
PYClog.pyc
PYCmixins.pyc
PYCproactor_events.pyc
PYCprotocols.pyc
PYCqueues.pyc
PYCrunners.pyc
PYCselector_events.pyc
PYCsslproto.pyc
PYCstaggered.pyc
PYCstreams.pyc
PYCsubprocess.pyc
PYCtaskgroups.pyc
PYCtasks.pyc
PYCthreads.pyc
PYCtimeouts.pyc
PYCtools.pyc
PYCtransports.pyc
PYCtrsock.pyc
PYCunix_events.pyc
PYCwindows_events.pyc
PYCwindows_utils.pyc
PYC__init__.pyc
PYC__main__.pyc
BINcollections
PYC__init__.pyc
BINcompression
PYCbz2.pyc
PYCgzip.pyc
PYClzma.pyc
PYCzlib.pyc
PYC__init__.pyc
BINzstd
PYC_zstdfile.pyc
PYC__init__.pyc
BIN_common
PYC_streams.pyc
PYC__init__.pyc
BINconcurrent
PYC__init__.pyc
BINfutures
PYCinterpreter.pyc
PYCprocess.pyc
PYCthread.pyc
PYC_base.pyc
PYC__init__.pyc
BINinterpreters
PYC_crossinterp.pyc
PYC_queues.pyc
PYC__init__.pyc
BINctypes
PYCutil.pyc
PYCwintypes.pyc
PYC_aix.pyc
PYC_endian.pyc
PYC_layout.pyc
PYC__init__.pyc
BINmacholib
PYCdyld.pyc
PYCdylib.pyc
BINfetch_macholib
BATfetch_macholib.bat
PYCframework.pyc
BINREADME.ctypes
PYC__init__.pyc
BINcurses
PYCascii.pyc
PYChas_key.pyc
PYCpanel.pyc
PYCtextpad.pyc
PYC__init__.pyc
BINdbm
PYCdumb.pyc
PYCgnu.pyc
PYCndbm.pyc
PYCsqlite3.pyc
PYC__init__.pyc
BINemail
RSTarchitecture.rst
PYCbase64mime.pyc
PYCcharset.pyc
PYCcontentmanager.pyc
PYCencoders.pyc
PYCerrors.pyc
PYCfeedparser.pyc
PYCgenerator.pyc
PYCheader.pyc
PYCheaderregistry.pyc
PYCiterators.pyc
PYCmessage.pyc
PYCparser.pyc
PYCpolicy.pyc
PYCquoprimime.pyc
PYCutils.pyc
PYC_encoded_words.pyc
PYC_header_value_parser.pyc
PYC_parseaddr.pyc
PYC_policybase.pyc
PYC__init__.pyc
BINmime
PYCapplication.pyc
PYCaudio.pyc
PYCbase.pyc
PYCimage.pyc
PYCmessage.pyc
PYCmultipart.pyc
PYCnonmultipart.pyc
PYCtext.pyc
PYC__init__.pyc
BINencodings
PYCaliases.pyc
PYCascii.pyc
PYCbase64_codec.pyc
PYCbig5.pyc
PYCbig5hkscs.pyc
PYCbz2_codec.pyc
PYCcharmap.pyc
PYCcp037.pyc
PYCcp1006.pyc
PYCcp1026.pyc
PYCcp1125.pyc
PYCcp1140.pyc
PYCcp1250.pyc
PYCcp1251.pyc
PYCcp1252.pyc
PYCcp1253.pyc
PYCcp1254.pyc
PYCcp1255.pyc
PYCcp1256.pyc
PYCcp1257.pyc
PYCcp1258.pyc
PYCcp273.pyc
PYCcp424.pyc
PYCcp437.pyc
PYCcp500.pyc
PYCcp720.pyc
PYCcp737.pyc
PYCcp775.pyc
PYCcp850.pyc
PYCcp852.pyc
PYCcp855.pyc
PYCcp856.pyc
PYCcp857.pyc
PYCcp858.pyc
PYCcp860.pyc
PYCcp861.pyc
PYCcp862.pyc
PYCcp863.pyc
PYCcp864.pyc
PYCcp865.pyc
PYCcp866.pyc
PYCcp869.pyc
PYCcp874.pyc
PYCcp875.pyc
PYCcp932.pyc
PYCcp949.pyc
PYCcp950.pyc
PYCeuc_jisx0213.pyc
PYCeuc_jis_2004.pyc
PYCeuc_jp.pyc
PYCeuc_kr.pyc
PYCgb18030.pyc
PYCgb2312.pyc
PYCgbk.pyc
PYChex_codec.pyc
PYChp_roman8.pyc
PYChz.pyc
PYCidna.pyc
PYCiso2022_jp.pyc
PYCiso2022_jp_1.pyc
PYCiso2022_jp_2.pyc
PYCiso2022_jp_2004.pyc
PYCiso2022_jp_3.pyc
PYCiso2022_jp_ext.pyc
PYCiso2022_kr.pyc
PYCiso8859_1.pyc
PYCiso8859_10.pyc
PYCiso8859_11.pyc
PYCiso8859_13.pyc
PYCiso8859_14.pyc
PYCiso8859_15.pyc
PYCiso8859_16.pyc
PYCiso8859_2.pyc
PYCiso8859_3.pyc
PYCiso8859_4.pyc
PYCiso8859_5.pyc
PYCiso8859_6.pyc
PYCiso8859_7.pyc
PYCiso8859_8.pyc
PYCiso8859_9.pyc
PYCjohab.pyc
PYCkoi8_r.pyc
PYCkoi8_t.pyc
PYCkoi8_u.pyc
PYCkz1048.pyc
PYClatin_1.pyc
PYCmac_arabic.pyc
PYCmac_croatian.pyc
PYCmac_cyrillic.pyc
PYCmac_farsi.pyc
PYCmac_greek.pyc
PYCmac_iceland.pyc
PYCmac_latin2.pyc
PYCmac_roman.pyc
PYCmac_romanian.pyc
PYCmac_turkish.pyc
PYCmbcs.pyc
PYCoem.pyc
PYCpalmos.pyc
PYCptcp154.pyc
PYCpunycode.pyc
PYCquopri_codec.pyc
PYCraw_unicode_escape.pyc
PYCrot_13.pyc
PYCshift_jis.pyc
PYCshift_jisx0213.pyc
PYCshift_jis_2004.pyc
PYCtis_620.pyc
PYCundefined.pyc
PYCunicode_escape.pyc
PYCutf_16.pyc
PYCutf_16_be.pyc
PYCutf_16_le.pyc
PYCutf_32.pyc
PYCutf_32_be.pyc
PYCutf_32_le.pyc
PYCutf_7.pyc
PYCutf_8.pyc
PYCutf_8_sig.pyc
PYCuu_codec.pyc
PYCzlib_codec.pyc
PYC_win_cp_codecs.pyc
PYC__init__.pyc
BINhtml
PYCentities.pyc
PYCparser.pyc
PYC__init__.pyc
BINhttp
PYCclient.pyc
PYCcookiejar.pyc
HTMcookies.pyc
PYCserver.pyc
VBS__init__.pyc
BINimportlib
PYCabc.pyc
PYCmachinery.pyc
PYCreaders.pyc
PYCsimple.pyc
PYCutil.pyc
PYC_abc.pyc
PYC_bootstrap.pyc
PYC_bootstrap_external.pyc
PYC__init__.pyc
BINmetadata
PYCdiagnose.pyc
PYC_adapters.pyc
PYC_collections.pyc
PYC_functools.pyc
PYC_itertools.pyc
PYC_meta.pyc
PYC_text.pyc
PYC__init__.pyc
BINresources
PYCabc.pyc
PYCreaders.pyc
PYCsimple.pyc
PYC_adapters.pyc
PYC_common.pyc
PYC_functional.pyc
PYC_itertools.pyc
PYC__init__.pyc
BINjson
PYCdecoder.pyc
PYCencoder.pyc
PYCscanner.pyc
PYCtool.pyc
PYC__init__.pyc
PYC__main__.pyc
BINlogging
PYCconfig.pyc
PYChandlers.pyc
PYC__init__.pyc
BINmultiprocessing
PYCconnection.pyc
PYCcontext.pyc
PYCforkserver.pyc
PYCheap.pyc
PYCmanagers.pyc
PYCpool.pyc
PYCpopen_fork.pyc
PYCpopen_forkserver.pyc
PYCpopen_spawn_posix.pyc
PYCpopen_spawn_win32.pyc
PYCprocess.pyc
PYCqueues.pyc
PYCreduction.pyc
PYCresource_sharer.pyc
PYCresource_tracker.pyc
PYCsharedctypes.pyc
PYCshared_memory.pyc
PYCspawn.pyc
PYCsynchronize.pyc
PYCutil.pyc
PYC__init__.pyc
BINdummy
PYCconnection.pyc
PYC__init__.pyc
BINpathlib
PYCtypes.pyc
PYC_os.pyc
PYC__init__.pyc
BINpydoc_data
VBStopics.pyc
CSS_pydoc.css
PYC__init__.pyc
BINre
PYC_casefix.pyc
PYC_compiler.pyc
PYC_constants.pyc
PYC_parser.pyc
PYC__init__.pyc
BINsite-packages
TXTREADME.txt
BINsqlite3
PYCdbapi2.pyc
PYCdump.pyc
PYC__init__.pyc
PYC__main__.pyc
BINstring
PYCtemplatelib.pyc
PYC__init__.pyc
BINsysconfig
PYC__init__.pyc
PYC__main__.pyc
BINtomllib
INImypy.ini
PYC_parser.pyc
PYC_re.pyc
PYC_types.pyc
PYC__init__.pyc
BINunittest
PYCasync_case.pyc
PYCcase.pyc
PYCloader.pyc
PYCmain.pyc
PYCmock.pyc
PYCresult.pyc
PYCrunner.pyc
PYCsignals.pyc
PYCsuite.pyc
PYCutil.pyc
PYC_log.pyc
PYC__init__.pyc
PYC__main__.pyc
BINurllib
PYCerror.pyc
PYCparse.pyc
PYCrequest.pyc
PYCresponse.pyc
PYCrobotparser.pyc
PYC__init__.pyc
BINwsgiref
PYChandlers.pyc
PYCheaders.pyc
PYCsimple_server.pyc
PYCtypes.pyc
PYCutil.pyc
PYCvalidate.pyc
PYC__init__.pyc
BINxml
PYC__init__.pyc
BINdom
PYCdomreg.pyc
PYCexpatbuilder.pyc
PYCminicompat.pyc
PYCminidom.pyc
PYCNodeFilter.pyc
PYCpulldom.pyc
PYCxmlbuilder.pyc
PYC__init__.pyc
BINetree
PYCcElementTree.pyc
PYCElementInclude.pyc
PYCElementPath.pyc
PYCElementTree.pyc
PYC__init__.pyc
BINparsers
PYCexpat.pyc
PYC__init__.pyc
BINsax
PYCexpatreader.pyc
PYChandler.pyc
PYCsaxutils.pyc
PYCxmlreader.pyc
PYC_exceptions.pyc
PYC__init__.pyc
BINxmlrpc
PYCclient.pyc
PYCserver.pyc
PYC__init__.pyc
BINzipfile
PYC__init__.pyc
PYC__main__.pyc
BIN_path
PYCglob.pyc
PYC__init__.pyc
BINzoneinfo
PYC_common.pyc
PYC_tzpath.pyc
PYC_zoneinfo.pyc
PYC__init__.pyc
BIN_pyrepl
PYCbase_eventqueue.pyc
PYCcommands.pyc
PYCcompleting_reader.pyc
PYCconsole.pyc
PYCfancy_termios.pyc
PYChistorical_reader.pyc
PYCinput.pyc
PYCkeymap.pyc
PYCmain.pyc
INImypy.ini
PYCpager.pyc
PYCreader.pyc
PYCreadline.pyc
PYCsimple_interact.pyc
PYCterminfo.pyc
PYCtrace.pyc
PYCtypes.pyc
PYCunix_console.pyc
PYCunix_eventqueue.pyc
PYCutils.pyc
PYCwindows_console.pyc
PYCwindows_eventqueue.pyc
PYC_module_completer.pyc
PYC_threading_handler.pyc
PYC__init__.pyc
PYC__main__.pyc
BIN__phello__
PYCspam.pyc
PYC__init__.pyc
BINham
PYCeggs.pyc
PYC__init__.pyc
EXEpythonw.exe
Structure
P7B[Authenticode]_971a0e40.p7b
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
EXEselect.pyd
Structure
P7B[Authenticode]_ef0b885b.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLsqlite3.dll
Structure
P7B[Authenticode]_3e0a0352.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEunicodedata.pyd
Structure
P7B[Authenticode]_de5fc6ec.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcruntime140.dll
Structure
P7B[Authenticode]_87ed8b9b.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcruntime140_1.dll
Structure
P7B[Authenticode]_abae8cb4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEwinsound.pyd
Structure
P7B[Authenticode]_44c594e3.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
PYss.py
PS1PowerShellScript
PS1[PowerShell Command]
BIN[Deobfuscated String]
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[Deobfuscated PS]
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䕌䄨䈷䒏䇯䕨
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
BINArchive
BINPowerShellScript
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 5secondary ignored: 8
bin 7img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path ole:doc>bin>scr:ps1~T1027~T1059.001
Shape ole:doc>bin>scr:ps1
malicious 3 nodes
Path ole:doc>scr:ps1~T1027~T1059.001
Shape ole:doc>scr:ps1
malicious 2 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
-noexihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
10 malicious · 731 files
OFF7268001f887c5a6290642a0dcf8a4529
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䕳䇲䆸䞷䄦䠥
PS1PowerShellScript
PS1[PowerShell Command]
BIN[Deobfuscated String]
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[Deobfuscated PS]
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䕌䄨䈷䒏䇯䕨
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
BINArchive
BINPowerShellScript
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
-noexihuhuhuhuhuhuhuhuhuhuhu
7268001f887c5a6290642a0dcf8a4529 › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙