Malicious
PE Executable
MD5: 9fe596f4a179c407569978a18985a0c1
Size: 3.07 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 9fe596f4a179c407569978a18985a0c1 |
| Sha1 | ca42f33c912302e49fa3542f7978962f947419f3 |
| Sha256 | 2e8b7a738ae3982c77f5751b4be096be2841167625190c245b7fb1858cd4ccd5 |
| Sha384 | 793a64ca5fbf57e0cb1bf71f5f97938a488f3b193945bd97d3d763a601a5542eb786794accb33da41410616fabe9a278 |
| Sha512 | 77d0d7f7b0365091dc6152a3b69d03a98d3bd24ce958a063f81eae807a08a3d1ca13e81393bf51abf29a18c925d86f49eedd40a6461eea270d678393d7d6bdea |
| SSDeep | 24576:zTbBv5rUfzpCTn72tmNlgEJMA+uCw7sULqP3NJV08P5Np6JZlP6+cO7TT63:tBA8Tn72tm3mA+IUP0lL2 |
| TLSH | D8E5A12439EE102DF1B3BFB59BD47596DA6EBE73370B544E1090238A4633A41DED123A |
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 6
STICH kept: 2secondary ignored: 4
bin
3img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>scr:vbs~T1059.005
Shape
pe:exe>scr:vbs
technique2 nodes
Path
pe:exe>scr:vbe>scr:vbe
Shape
pe:exe>scr:vbe>scr:vbe
3 nodes
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_a30f0baf.bin (2512210 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |