Deep Malware Analysis of 918ad3516e0ef9d896bc75a31a81d86e | md5: 918ad3516e0ef9d896bc75a31a81d86e | Contains Base64 Block | Base64 Block | Base64 Payload | Executable | PE (Portable Executable) | PE Memory-Mapped (Dump) | SOS: 0.62 | PowerShell | Batch Command | PowerShell Call | Scripting.FileSystemObject | WScript.Shell | Shell.Application | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | T1059 | COM Behavior Trace | T1059.001

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	918ad3516e0ef9d896bc75a31a81d86e
Sha1	e3cb02771517a6001c23f5a3f8a5d8ef6761690b
Sha256	df5ca1884dc8dd8514902293e21def2724b2d069c0bbce387747d843c4acd0c2
Sha384	f8909aaea278836ce84faed7c3f61d79ce5fae0d1eb7d62108b55cf0fd698c03438a3e3318e6ac2a1bce31727d329c97
Sha512	b5932cecd28f7198d10ed044d7032d840b51ca488067fc7f546d4538e8cbc4e276297c5dd793af30dafa2b3d9fb6ce78b025984e8bdf3f31243f713d4541d3e0
SSDeep	49152:OuKgLhKqcYxa1yZbtLfMRomdaARfM+1CjVUy4Jd/hvQRN0ynJT8rY7ANAWdFVFQ9:h
TLSH	6276E0334A13BCEE3B7E2D84D4002D451C2C2E9797648658FB8835BB76E9294DF2E5B4

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001

Shape scr:vbs>scr:bat>scr:ps1

malicious 3 nodes

Path scr:vbs~T1027~T1059~T1059.005>pe:exe

Shape scr:vbs>pe:exe

malicious 2 nodes

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Command (COM trace) #1 UNKNWOWNmalicious

cmd.exhuhuhuhuhuhuhuhuhuhuhu

Command (COM trace) #2 UNKNWOWNmalicious

"C:\Ushuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

net huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential