Suspicious
Suspect

79115016bad10c3465e2bd4028ebeaa0

Share on LinkedIn
Print
VBScript
MD5: 79115016bad10c3465e2bd4028ebeaa0
Size: 1.16 MB
text/vbscript

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 79115016bad10c3465e2bd4028ebeaa0
Sha1 d1b23336990df1162a0e6f3d13ab0256cabafe25
Sha256 a654487377017fceb2b2f53f6694e9d999df80d4037af57149b4eec8f28cb236
Sha384 04d8d03b0d0b5cfda222f58d986b1d640ab0316751b9b46379b2717429fbf792e6c94e19f5f2e1cc7a0e7ca9a4679bbe
Sha512 e4a9d241fe1eba774e298005ff9ee710fee304aafa4ae31e982093c3d1aae9ddb35883294fb7b5c4cdac15dfa774247aa6921fd517e0fbe80d236cd893bcd637
SSDeep 12288:ar864d8aAhq7ZhutOR4nVcEMQ2KO6ct/QBhApzP6vaiARO77L4e78qKhpCA:A4yaYqycm+I2KNhQzi5IO77L4xMA
TLSH 3E35D00013A84F58E67FE334C872261086F7FC968DB2D3DE6AC4689D3936B569691733
79115016bad10c3465e2bd4028ebeaa0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Estigan.6423897.bak
fDk8B7kn.Resources.resources
e6881e993acbbf.Resources.resources
c8c720af0
[NBF]root.Data
c8c720af1
[NBF]root.Data
c8c720af10
[NBF]root.Data
c8c720af11
[NBF]root.Data
c8c720af12
[NBF]root.Data
c8c720af13
[NBF]root.Data
c8c720af14
[NBF]root.Data
c8c720af15
[NBF]root.Data
c8c720af16
[NBF]root.Data
c8c720af17
[NBF]root.Data
c8c720af18
[NBF]root.Data
c8c720af19
[NBF]root.Data
c8c720af2
[NBF]root.Data
c8c720af20
[NBF]root.Data
c8c720af21
[NBF]root.Data
c8c720af22
[NBF]root.Data
c8c720af23
[NBF]root.Data
c8c720af24
[NBF]root.Data
c8c720af3
[NBF]root.Data
c8c720af4
[NBF]root.Data
c8c720af5
[NBF]root.Data
c8c720af6
[NBF]root.Data
c8c720af7
[NBF]root.Data
c8c720af8
[NBF]root.Data
c8c720af9
[NBF]root.Data
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 1secondary ignored: 2
bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>scr:vbs
Shape pe:exe>scr:vbs
2 nodes
Name Value
Module Name
fDk8B7kn
Full Name
fDk8B7kn
EntryPoint
System.Void fDk8B7kn.on8YAib7g5aC4::wZx03jAae()
Scope Name
fDk8B7kn
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
fDk8B7kn
Assembly Version
18.15.44.242
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Info
PE Detect: PeReader OK (file layout)
Total Strings
1228
Main Method
System.Void fDk8B7kn.on8YAib7g5aC4::wZx03jAae()
Main IL Instruction Count
14
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldstr 6423897.bak
call System.Void fDk8B7kn.Hy7pm3Twas6R::Fo7ix9fEr(System.String)
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙