Suspicious
Suspect

73672a669a8176a3cdf9c8177865b6aa

PE Executable
MD5: 73672a669a8176a3cdf9c8177865b6aa
Size: 841.83 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 73672a669a8176a3cdf9c8177865b6aa
Sha1 acb959c8f003298866ac11624b892be7505d8a0a
Sha256 cf3657cfdbdd80eeb98a4dae53615227703e6ba3dd61f60f9a88b35e032df847
Sha384 c8579151b8c0b482a4365b6664965b601cd911f7bfc0c73edabf2a552b0ea35f8b9ff978e22739fe6c917927d3194b16
Sha512 9e6183ca9a7c363998516d71d8eac091bc64fa766e6803fd6420b381622502fb0784e43c22ade86b51f3b8363cf51157c12b9ed7988a85d13337401c5f377fee
SSDeep 12288:hTUYUaJr/kGOXKCw0V8WTECwS6MtJy3tw34rRKnXX57uPz/fSo8QJt5T5EtCciuv:hTUYUaKXRCWJwS6dAXX5iPDgQ5TgVi
TLSH AF05F1A037BADA4FD3B30A7852D263B1B5F8DD2A261B9707626376884D333E45385C71
PeID
Installer Nullsoft PiMP Stub v.3.0.x - A.S.L Microsoft Visual C++ v6.0 DLL
[NSIS Installer] @ #00028008
undervisningsmaterialet
Ebonits.fib
Foreordained
Orcadian.ini
Venerable.ini
adonizing.jpg
adonizing.jpg-preview.png
espergrdes.txt
indstvner.ini
semirigid.ini
snuffily.ini
taaens.txt
tusindbenets.ini
unidealistic.jpg
unidealistic.jpg-preview.png
zenzuic.opl
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.reloc
[SETUP_DECOMPILED.NSI]
[Authenticode]_6fb08d4c.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.ndata
.rsrc
Resources
RT_BITMAP
ID:006E
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
RT_DIALOG
ID:0068
ID:1033
ID:0069
ID:1033
ID:006A
ID:1033
ID:006B
ID:1033
ID:006F
ID:1033
RT_GROUP_CURSOR4
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3
bin 2img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:dll
Shape pe:exe>pe:dll
2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0xCC658 size 4624 bytes
[NSIS Installer] @ #00028008
undervisningsmaterialet
Ebonits.fib
Foreordained
Orcadian.ini
Venerable.ini
adonizing.jpg
adonizing.jpg-preview.png
espergrdes.txt
indstvner.ini
semirigid.ini
snuffily.ini
taaens.txt
tusindbenets.ini
unidealistic.jpg
unidealistic.jpg-preview.png
zenzuic.opl
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.reloc
[SETUP_DECOMPILED.NSI]
[Authenticode]_6fb08d4c.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.ndata
.rsrc
Resources
RT_BITMAP
ID:006E
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
RT_DIALOG
ID:0068
ID:1033
ID:0069
ID:1033
ID:006A
ID:1033
ID:006B
ID:1033
ID:006F
ID:1033
RT_GROUP_CURSOR4
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙