Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 604.7 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 102 embedded or derived files. It matches 106 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059, T1059.001, T1059.005 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c
MD5
77c9f45ba9801e889db7195e36abef03
Verdict
Malicious
File type
PE Executable · 604.7 KB
MITRE ATT&CK
T1027T1059T1059.001T1059.005T1059.007

Cite this report: https://app.malva.re/sha256/4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
619.18 KB · 619,178 B
First seen
2026-10-27 18:45 · 2 days ago
Last seen
2026-10-27 18:45 · 2 days ago
Last analysis
2026-10-27 18:45 · 2 days ago
Hashes
MD5 77c9f45ba9801e889db7195e36abef03 Sha1 65db9681e800ebd2af716972cfa0e2c3bf08ec0a Sha256 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c Sha384 9b65f16c63311c4e6e114b7a0e7b8fffb9a44451ce28f1ab413ca18d63a007e02f004c8eb9017676ee7ff1c31f015a19 Sha512 21b967ec4806dc1bb1096f9083fe2d45525d19d1a86bef9d3af8075c56ba59987e2587ccd47675270f6a275755fb431723552f84633824cec5517b235c414e57 SSDeep 12288:R3mgqnIZuYfCYqFet4CovkM7c6GnEIRAQRFehgtq:R3WnIZuMCxezot716BAQRFEOq TLSH 06D48D32A5614033FBF10573B928A6303E7CE728275188A9D7D4AD1D7EB8482A7F7257
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation

62 malicious · 103 files
EXE77c9f45ba9801e889db7195e36abef03
Structure
BIN0
BINOverlay_514150cf.bin
EXEu0
Structure
P7B[Authenticode]_443dc53d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
BINu1
BINu2
IMGu3
IMGu3-preview.png
BINu4
OFFa0
JSi_reUhh9jhTE
PS1JUkEqNhc2S0N
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBSySatvUyljdhl
VBSySatvUyljdhl.deobfuscated.vbs
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䋜䕲䆷䗸
BIN䡀䕙䓲䕨䜷
BIN䕙䇲䆸䞷䄦䠥
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINRT_MESSAGETABLE
BINID:0001
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 3secondary ignored: 6
bin 5img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>ole:doc>scr:ps1~T1027~T1059.001
Shape pe:exe>ole:doc>scr:ps1
malicious 3 nodes
Path pe:exe>ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape pe:exe>ole:doc>scr:vbs
malicious 3 nodes

Name Value
Info
Overlay extracted: Overlay_514150cf.bin (139434 bytes)
Info
PDB Path: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

62 malicious · 103 files
EXE77c9f45ba9801e889db7195e36abef03
Structure
BIN0
BINOverlay_514150cf.bin
BINu1
BINu2
BINu4
OFFa0
JSi_reUhh9jhTE
PS1JUkEqNhc2S0N
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBSySatvUyljdhl
VBSySatvUyljdhl.deobfuscated.vbs
No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
77c9f45ba9801e889db7195e36abef03 › a0 › ySatvUyljdhl
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙