Suspicious
Suspect

855a7d9da970dd7004a886c91bfda171

Share on LinkedIn
Print
PE Executable
MD5: 855a7d9da970dd7004a886c91bfda171
Size: 428.28 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 855a7d9da970dd7004a886c91bfda171
Sha1 d7547ce372b2c0a25439f77ad98e1ddc2d5f1eda
Sha256 66a1be3919f3f23710ebc6d58daf04e5abd52490f4a95993cea670cfc2314809
Sha384 29f958a86c5ad1b7d3a2fa500f1bcb9b778f262d26ebf658cff3b99e3d8c4a9472d15d87003d5bc4ffb2705314f90899
Sha512 91acfae799810a3e641564026b716d285dfffaaead4e7a8eb5a92aaa4eb35249023b546b19ebff514fd6c88a896c1e96ee08392201af59c00637df01559a24d0
SSDeep 6144:lXsKoG8pL7qzqAeYyEM5zVPZI9PZY630ExBGogd6MOjZaM9oQEfj7S/fNM/f6HxZ:lXuLsq/DIVv5cdDO1aM9VGe/m/UDT
TLSH FB9412962690D727C3761D76F954D6DDDBACAA10A2B49BA313F03A4FB832EC5440F321
PeID
Microsoft Visual C++ v6.0 DLL
[NSIS Installer] @ #0000FC08
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.reloc
Extracorporeally
Familieaktieselskabers.jpg
Familieaktieselskabers.jpg-preview.png
Finials.mer
Foreningen14.jpg
Foreningen14.jpg-preview.png
chathamite.txt
eiry.jpg-preview.png
gedebollernes.jpg
gedebollernes.jpg-preview.png
pegroots.txt
pressionsgruppens.jpg
pressionsgruppens.jpg-preview.png
[SETUP_DECOMPILED.NSI]
[Authenticode]_ff406b1f.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.ndata
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
RT_DIALOG
ID:0069
ID:1033
ID:006A
ID:1033
ID:006B
ID:1033
ID:006F
ID:1033
RT_GROUP_CURSOR4
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3
bin 2img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:dll
Shape pe:exe>pe:dll
2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x67F90 size 2408 bytes
An error has occurred. This application may no longer respond until reloaded. Reload 🗙