Suspicious
Suspect

8b833319a80ffc1879722fb1455fb419

PE Executable
MD5: 8b833319a80ffc1879722fb1455fb419
Size: 299.01 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 8b833319a80ffc1879722fb1455fb419
Sha1 3b3bf71a90397816cc6cb8f17d5dd82355fbcb38
Sha256 5ce68cd389e40ef322cbbc76361b78e4ab9cd7b8bd4942b903b9bdbd338609df
Sha384 3df2ebffb139089ff33d018add8c1d1f7b36d3c0617b9b89cb64c90afa5b20034be4e8f8caa93e1d2c8559a5816ab9ae
Sha512 95c89b006aac3f9f4eeb607045972fc6f35ac67092a9d58ee9e8f0129d3658d2a98aea6c09ae0b42df54b5df062007640b60e3def3c53bb149ee44037516a97e
SSDeep 6144:h6R+qTbitQ5DH6p03wJt82lfFmi+oypDe/q4vTNkV3huTYANwEROc:0+q3itQt60gJt8EfFOoypa/q4velhu9D
TLSH 3B54226FF7EC5A0CE77F32726D451869D9B0F84A955ED23CC0E1A1C88A4C6C91209B7E
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
8b833319a80ffc1879722fb1455fb419
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TaleWeaveBundle
www
app.js
index.html
style.css
Microsoft-WebView2-LICENSE.txt
Microsoft.Web.WebView2.Core.dll
[Authenticode]_1030ea96.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Microsoft.Web.WebView2.WinForms.dll
.Net Resources
Microsoft.Web.WebView2.WinForms.Microsoft.Web.WebView2.WinForm.WebView2.bmp
[Authenticode]_7db34c18.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
TaleWeave.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
WebView2Loader.dll
[Authenticode]_27b284e9.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.tls
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
WINDOWS-README.txt
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 1secondary ignored: 6
bin 5img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>arc:zip>html
Shape pe:exe>arc:zip>html
3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
TaleWeave-Setup.exe
Full Name
TaleWeave-Setup.exe
EntryPoint
System.Void TaleWeaveSetup.Program::Main(System.String[])
Scope Name
TaleWeave-Setup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
TaleWeave-Setup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
37
Main Method
System.Void TaleWeaveSetup.Program::Main(System.String[])
Main IL Instruction Count
152
Main IL 
call System.Byte[] TaleWeaveSetup.Program::ReadBundle()
stloc.0 <null>
ldloc.0 <null>
call System.String TaleWeaveSetup.Program::Hash(System.Byte[])
ldstr D5EA1991025D275E03C2BAE270BB19A7A6D7A601F222D304EFA422A8692A1FB7
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue.s IL_0024: ldarg.0
ldstr インストールデータの整合性を確認できませんでした。
newobj System.Void System.IO.InvalidDataException::.ctor(System.String)
throw <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
bne.un.s IL_008E: ldc.i4.s 28
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --verify-only
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_008E: ldc.i4.s 28
call System.String System.IO.Path::GetTempPath()
ldstr TaleWeaveVerify-
call System.Guid System.Guid::NewGuid()
stloc.s V_8
ldloca.s V_8
ldstr N
call System.String System.Guid::ToString(System.String)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldloc.0 <null>
ldloc.1 <null>
call System.Void TaleWeaveSetup.Program::Extract(System.Byte[],System.String)
ldloc.1 <null>
ldloc.0 <null>
call System.Boolean TaleWeaveSetup.Program::Verify(System.String,System.Byte[])
brtrue.s IL_0077: leave.s IL_0089
ldc.i4.2 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0089: leave IL_01D3
ldloc.1 <null>
call System.Boolean System.IO.Directory::Exists(System.String)
brfalse.s IL_0088: endfinally
ldloc.1 <null>
ldc.i4.1 <null>
call System.Void System.IO.Directory::Delete(System.String,System.Boolean)
endfinally <null>
leave IL_01D3: ret
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr Programs
ldstr TaleWeave
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
ldstr 1.0.0-
ldstr D5EA1991025D275E03C2BAE270BB19A7A6D7A601F222D304EFA422A8692A1FB7
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32,System.Int32)
callvirt System.String System.String::ToLowerInvariant()
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
ldloc.0 <null>
call System.Boolean TaleWeaveSetup.Program::Verify(System.String,System.Byte[])
brtrue IL_0166: ldloc.3
ldloc.2 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.2 <null>
ldstr .install-
call System.Guid System.Guid::NewGuid()
stloc.s V_9
ldloca.s V_9
ldstr N
call System.String System.Guid::ToString(System.String)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_4
ldloc.0 <null>
ldloc.s V_4
call System.Void TaleWeaveSetup.Program::Extract(System.Byte[],System.String)
ldloc.s V_4
ldloc.0 <null>
call System.Boolean TaleWeaveSetup.Program::Verify(System.String,System.Byte[])
brtrue.s IL_011C: ldloc.3
ldstr 展開したファイルの整合性を確認できませんでした。
newobj System.Void System.IO.InvalidDataException::.ctor(System.String)
throw <null>
ldloc.3 <null>
call System.Boolean System.IO.Directory::Exists(System.String)
brfalse.s IL_015E: ldloc.s V_4
ldloc.2 <null>
ldstr 1.0.0-
ldstr D5EA1991025D275E03C2BAE270BB19A7A6D7A601F222D304EFA422A8692A1FB7
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32,System.Int32)
callvirt System.String System.String::ToLowerInvariant()
ldstr -repair-
call System.DateTime System.DateTime::get_UtcNow()
stloc.s V_10
ldloca.s V_10
ldstr yyyyMMddHHmmss
call System.String System.DateTime::ToString(System.String)
call System.String System.String::Concat(System.String,System.String,System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.s V_4
ldloc.3 <null>
call System.Void System.IO.Directory::Move(System.String,System.String)
ldloc.3 <null>
ldstr TaleWeave.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_5
ldloc.s V_5
call System.Void TaleWeaveSetup.Program::CreateShortcut(System.String)
ldloc.s V_5
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
ldloc.3 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldstr TaleWeaveをインストールし、起動しました。
スタートメニューにも追加されています。
ldstr TaleWeave Setup
ldc.i4.0 <null>
ldc.i4.s 64
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave.s IL_01D3: ret
stloc.s V_7
ldstr インストールできませんでした。


ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr TaleWeave Setup
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave.s IL_01D3: ret
ret <null>
8b833319a80ffc1879722fb1455fb419
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TaleWeaveBundle
www
app.js
index.html
style.css
Microsoft-WebView2-LICENSE.txt
Microsoft.Web.WebView2.Core.dll
[Authenticode]_1030ea96.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Microsoft.Web.WebView2.WinForms.dll
.Net Resources
Microsoft.Web.WebView2.WinForms.Microsoft.Web.WebView2.WinForm.WebView2.bmp
[Authenticode]_7db34c18.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
TaleWeave.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
WebView2Loader.dll
[Authenticode]_27b284e9.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.tls
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
WINDOWS-README.txt
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙