Malicious
7e29dd50712b2f02b0464b835e6f30af
MD5: 7e29dd50712b2f02b0464b835e6f30af
Size: 4.34 MB
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
4.34 MB · 4,342,641 B
Hashes
MD5
7e29dd50712b2f02b0464b835e6f30af
Sha1
4a997e8b82985ca758503c6ac6825c77b9fd394b
Sha256
8c65239167f3ec609a5a992ed143b68b3c1b3a5985cf8a6d3f528081de15d0ee
Sha384
51aafd0369d6489f32701503fef8e1f93fb2ffa3386b4cb6ae327d437bb05d6b01ba199f4301baeaeaa89e20b4dc8143
Sha512
3c59106561167810cf88bf30b4bc4249853f948033b3837ada8150cd695cfbae8d8dda2184c91b11100dfe68288f1c33aa0f513e96291e265122ef3350acbc68
SSDeep
98304:a+h77Dw34jm8qq2VsIWvhL1fdf8nWSD5CzbNzhLnfdVvgj:a4T3j48h5fgW0KVhYj
TLSH
A51633171202BCF1F2FA633251A825457CE4AE675275EFB9C508435FB9A33E81A6C723
Detection
PeID
Microsoft Visual C++ v6.0 DLL
9 malicious · 36 files
NSIS7e29dd50712b2f02b0464b835e6f30afT1027 · T1059 · T1059.001
Structure
BINOverlay_5d3ba538.bin
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
IMGID:1033
IMGID:1033-preview.png
BINID:0004
BINID:1033
BINRT_DIALOG
BINID:0069
BINID:1033
BINID:006A
BINID:1033
BINID:006F
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0067
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
BIN[NSIS Installer] @ #0000DA08
PS1Setup.vbsT1027 · T1059 · T1059.001
VBSSetup.vbs.deobfuscated.vbsT1059.001 · T1059.005
SH[Command #0] T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
DATdummy_padding.dat
PS1.runner.ps1T1059.001
PS1[PowerShell Command]T1059.001
JSONfile1_info.json
JSONfile2_info.json
PART9TXEMqbnluzw.part
PARTA22mX6i2QQiZ.part
PARTKxnm0tCGjfpS.part
PARTPZNk3GFdnv5e.part
PARTTVhTUNlxa8aE.part
PARTXFmw5hRXAmeS.part
PARTg8ZqtBo45ioR.part
EXEvMeZ429PmCUI.part
PARTyuaDDOrDHtrv.part
PARTFL3P5eWtT4SV.part
PARTPip5qPhhCYEn.part
EXEaQLz7LlC4ujL.part
NSI][SETUP_DECOMPILED.NSI]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 7
STICH kept: 4secondary ignored: 3
bin
2img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
pe:exe>scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:bat>scr:ps1~T1059.001
Shape
pe:exe>scr:ps1>scr:bat>scr:ps1
malicious
4 nodes
Path
pe:exe>scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:vbs~T1059.005>scr:ps1~T1059.001
Shape
pe:exe>scr:ps1>scr:vbs>scr:ps1
malicious
4 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_5d3ba538.bin (4286833 bytes) |
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential9 malicious · 36 files
NSIS7e29dd50712b2f02b0464b835e6f30afT1027 · T1059 · T1059.001
Structure
BINOverlay_5d3ba538.bin
BINResources
BIN[NSIS Installer] @ #0000DA08
PS1Setup.vbsT1027 · T1059 · T1059.001
VBSSetup.vbs.deobfuscated.vbsT1059.001 · T1059.005
SH[Command #0] T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
DATdummy_padding.dat
PS1.runner.ps1T1059.001
PS1[PowerShell Command]T1059.001
JSONfile1_info.json
JSONfile2_info.json
PART9TXEMqbnluzw.part
PARTA22mX6i2QQiZ.part
PARTKxnm0tCGjfpS.part
PARTPZNk3GFdnv5e.part
PARTTVhTUNlxa8aE.part
PARTXFmw5hRXAmeS.part
PARTg8ZqtBo45ioR.part
EXEvMeZ429PmCUI.part
PARTyuaDDOrDHtrv.part
PARTFL3P5eWtT4SV.part
PARTPip5qPhhCYEn.part
EXEaQLz7LlC4ujL.part
NSI][SETUP_DECOMPILED.NSI]
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
7e29dd50712b2f02b0464b835e6f30af › [NSIS Installer] @ #0000DA08 › Setup.vbs
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
7e29dd50712b2f02b0464b835e6f30af › [NSIS Installer] @ #0000DA08 › aQLz7LlC4ujL.part
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account