Suspicious
Suspect

8b833319a80ffc1879722fb1455fb419

Share on LinkedIn
Print
PE Executable
MD5: 8b833319a80ffc1879722fb1455fb419
Size: 299.01 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 8b833319a80ffc1879722fb1455fb419
Sha1 3b3bf71a90397816cc6cb8f17d5dd82355fbcb38
Sha256 5ce68cd389e40ef322cbbc76361b78e4ab9cd7b8bd4942b903b9bdbd338609df
Sha384 3df2ebffb139089ff33d018add8c1d1f7b36d3c0617b9b89cb64c90afa5b20034be4e8f8caa93e1d2c8559a5816ab9ae
Sha512 95c89b006aac3f9f4eeb607045972fc6f35ac67092a9d58ee9e8f0129d3658d2a98aea6c09ae0b42df54b5df062007640b60e3def3c53bb149ee44037516a97e
SSDeep 6144:h6R+qTbitQ5DH6p03wJt82lfFmi+oypDe/q4vTNkV3huTYANwEROc:0+q3itQt60gJt8EfFOoypa/q4velhu9D
TLSH 3B54226FF7EC5A0CE77F32726D451869D9B0F84A955ED23CC0E1A1C88A4C6C91209B7E
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
8b833319a80ffc1879722fb1455fb419
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TaleWeaveBundle
www
app.js
index.html
style.css
Microsoft-WebView2-LICENSE.txt
Microsoft.Web.WebView2.Core.dll
[Authenticode]_1030ea96.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Microsoft.Web.WebView2.WinForms.dll
.Net Resources
Microsoft.Web.WebView2.WinForms.Microsoft.Web.WebView2.WinForm.WebView2.bmp
[Authenticode]_7db34c18.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
TaleWeave.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
WebView2Loader.dll
[Authenticode]_27b284e9.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.tls
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
WINDOWS-README.txt
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 1secondary ignored: 6
bin 5img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>arc:zip>html
Shape pe:exe>arc:zip>html
3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
TaleWeave-Setup.exe
Full Name
TaleWeave-Setup.exe
EntryPoint
System.Void TaleWeaveSetup.Program::Main(System.String[])
Scope Name
TaleWeave-Setup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
TaleWeave-Setup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
37
Main Method
System.Void TaleWeaveSetup.Program::Main(System.String[])
Main IL Instruction Count
152
Main IL 
call System.Byte[] TaleWeaveSetup.Program::ReadBundle()
stloc.0 <null>
ldloc.0 <null>
call System.String TaleWeaveSetup.Program::Hash(System.Byte[])
ldstr D5EA1991025D275E03C2BAE270BB19A7A6D7A601F222D304EFA422A8692A1FB7
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue.s IL_0024: ldarg.0
ldstr インストールデータの整合性を確認できませんでした。
newobj System.Void System.IO.InvalidDataException::.ctor(System.String)
throw <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
bne.un.s IL_008E: ldc.i4.s 28
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --verify-only
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_008E: ldc.i4.s 28
call System.String System.IO.Path::GetTempPath()
ldstr TaleWeaveVerify-
call System.Guid System.Guid::NewGuid()
stloc.s V_8
ldloca.s V_8
ldstr N
call System.String System.Guid::ToString(System.String)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldloc.0 <null>
ldloc.1 <null>
call System.Void TaleWeaveSetup.Program::Extract(System.Byte[],System.String)
ldloc.1 <null>
ldloc.0 <null>
call System.Boolean TaleWeaveSetup.Program::Verify(System.String,System.Byte[])
brtrue.s IL_0077: leave.s IL_0089
ldc.i4.2 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0089: leave IL_01D3
ldloc.1 <null>
call System.Boolean System.IO.Directory::Exists(System.String)
brfalse.s IL_0088: endfinally
ldloc.1 <null>
ldc.i4.1 <null>
call System.Void System.IO.Directory::Delete(System.String,System.Boolean)
endfinally <null>
leave IL_01D3: ret
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr Programs
ldstr TaleWeave
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
ldstr 1.0.0-
ldstr D5EA1991025D275E03C2BAE270BB19A7A6D7A601F222D304EFA422A8692A1FB7
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32,System.Int32)
callvirt System.String System.String::ToLowerInvariant()
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
ldloc.0 <null>
call System.Boolean TaleWeaveSetup.Program::Verify(System.String,System.Byte[])
brtrue IL_0166: ldloc.3
ldloc.2 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.2 <null>
ldstr .install-
call System.Guid System.Guid::NewGuid()
stloc.s V_9
ldloca.s V_9
ldstr N
call System.String System.Guid::ToString(System.String)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_4
ldloc.0 <null>
ldloc.s V_4
call System.Void TaleWeaveSetup.Program::Extract(System.Byte[],System.String)
ldloc.s V_4
ldloc.0 <null>
call System.Boolean TaleWeaveSetup.Program::Verify(System.String,System.Byte[])
brtrue.s IL_011C: ldloc.3
ldstr 展開したファイルの整合性を確認できませんでした。
newobj System.Void System.IO.InvalidDataException::.ctor(System.String)
throw <null>
ldloc.3 <null>
call System.Boolean System.IO.Directory::Exists(System.String)
brfalse.s IL_015E: ldloc.s V_4
ldloc.2 <null>
ldstr 1.0.0-
ldstr D5EA1991025D275E03C2BAE270BB19A7A6D7A601F222D304EFA422A8692A1FB7
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32,System.Int32)
callvirt System.String System.String::ToLowerInvariant()
ldstr -repair-
call System.DateTime System.DateTime::get_UtcNow()
stloc.s V_10
ldloca.s V_10
ldstr yyyyMMddHHmmss
call System.String System.DateTime::ToString(System.String)
call System.String System.String::Concat(System.String,System.String,System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.s V_4
ldloc.3 <null>
call System.Void System.IO.Directory::Move(System.String,System.String)
ldloc.3 <null>
ldstr TaleWeave.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_5
ldloc.s V_5
call System.Void TaleWeaveSetup.Program::CreateShortcut(System.String)
ldloc.s V_5
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
ldloc.3 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldstr TaleWeaveをインストールし、起動しました。
スタートメニューにも追加されています。
ldstr TaleWeave Setup
ldc.i4.0 <null>
ldc.i4.s 64
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave.s IL_01D3: ret
stloc.s V_7
ldstr インストールできませんでした。


ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr TaleWeave Setup
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave.s IL_01D3: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙