Malicious
a629b59531a0780aeca540022274541f
PE Executable
MD5: a629b59531a0780aeca540022274541f
Size: 16.9 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
16.9 MB · 16,897,894 B
First seen
2026-08-22 01:15 · 2 months ago
Last seen
2026-08-22 01:15 · 2 months ago
Last analysis
2026-09-03 18:08 · one month ago
Hashes
MD5
a629b59531a0780aeca540022274541f
Sha1
e2024640bbdabd720dcb2464de2e03e7dca2eb9d
Sha256
9f4e2dc6f2aeeb950936285e8e47f805d4e3d843e0912df08f49dc6e53bdf152
Sha384
d04402530cc180f04f814e22aa88a0ee800aafdbc469d72ea59828629e80693ad142485c547da6e58e24fca2480e226f
Sha512
e34af5ddbc6d3ca15096a36a9a8e27709c3262d238ac40b88b157fa755e50e7bb2775de865314152959d6333a3cdd3572ebacebd7b1fc099d69790e890721010
SSDeep
393216:oGylmOkvbt+C1CRwPsUto4GkF9fwYFSW48o4Q4Y3RsW8s:VylzU1ZsUTF9YYzrop4/3s
TLSH
74073314EB9420F5FC72D131CAB34BE1D9327846072066EB3B9079A75EF7295CA36722
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
19 malicious · 57 files
EXEa629b59531a0780aeca540022274541fT1027 · T1059 · T1059.001
Structure
RAROverlay_c5b9c6ad.binT1027 · T1059 · T1059.001
PS1OpenLink.ps1
EXEae_mixtwo.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
DLLLfdReader.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINIBar2Double&&
ZIPLX_UL0vcsT_f5w5_.zip
EXEr19.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
LISTILRepack.List
LISTILRepack.List
VBSRunSilent.vbsT1027 · T1059 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
BINRunSilent.vbs.deobfuscated.vbs
SH[Command #0]
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINID:0011
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 11
STICH kept: 2secondary ignored: 9
bin
8img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>arc:rar>scr:vbs~T1059~T1059.005>scr:bat
Shape
pe:exe>arc:rar>scr:vbs>scr:bat
malicious
4 nodes
Path
pe:exe>arc:rar>scr:vbs~T1059~T1059.005>scr:ps1~T1027~T1059.001
Shape
pe:exe>arc:rar>scr:vbs>scr:ps1
malicious
4 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_c5b9c6ad.bin (16417126 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"scriphuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"ko"
huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential19 malicious · 57 files
EXEa629b59531a0780aeca540022274541fT1027 · T1059 · T1059.001
Structure
RAROverlay_c5b9c6ad.binT1027 · T1059 · T1059.001
PS1OpenLink.ps1
EXEae_mixtwo.exe
VBSRunSilent.vbsT1027 · T1059 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
BINRunSilent.vbs.deobfuscated.vbs
SH[Command #0]
BINResources
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a629b59531a0780aeca540022274541f › Overlay_c5b9c6ad.bin › RunSilent.vbs
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
a629b59531a0780aeca540022274541f › Overlay_c5b9c6ad.bin › RunSilent.vbs › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"scriphuhuhuhuhuhuhuhuhuhuhu
a629b59531a0780aeca540022274541f › Overlay_c5b9c6ad.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
a629b59531a0780aeca540022274541f › Overlay_c5b9c6ad.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
a629b59531a0780aeca540022274541f › Overlay_c5b9c6ad.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"ko"
huhuhuhuhuhuhuhuhuhuhu
a629b59531a0780aeca540022274541f › Overlay_c5b9c6ad.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
a629b59531a0780aeca540022274541f › Overlay_c5b9c6ad.bin › RunSilent.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account