Deep Malware Analysis of a1df599c924b506851cface2c97f0be6 | md5: a1df599c924b506851cface2c97f0be6 | Zip Archive | Executable | PE (Portable Executable) | PE File Layout | PDB Path | SOS: 0.28 | Excel.Application | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	a1df599c924b506851cface2c97f0be6
Sha1	92ff8be19442befaf32397a14af7d255198c884e
Sha256	eaca658a963bafb0998aada2c79864d42f526dc34076033005f4b34f236d76b1
Sha384	e1da3b8a4ebea5a2ccfdd62ec6c4400bdabe736bf13d5cb20c8b674c9c6ea436aac42c6bb5582f85a685802c66c0618c
Sha512	35d1496ebcd4f66a0d87d38f445da8c982378f15508fd05a5f5586f2886b2b75ba4af17706c63fb72066105a245961e7f6be604ae9e3a2528e31dc3dca7a8171
SSDeep	786432:8NhkPmeNDUzxbx1baSqvogaLUUS6jdG3q7xXSc:y+DNDUzxeU/AUlRGWxSc
TLSH	754733C6F61A5BB4D2902044357D3E67A8F2FD377F0C8402A7E7E68791CF9A2A6241D4

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5

bin 4img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>pe:exe>pe:rsrc>scr:vbs~T1027~T1059.005

Shape arc:zip>pe:exe>pe:rsrc>scr:vbs

malicious 4 nodes

Path arc:zip>pe:exe>pe:rsrc>html

Shape arc:zip>pe:exe>pe:rsrc>html

4 nodes

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential