Malicious
PE Executable
MD5: a629b59531a0780aeca540022274541f
Size: 16.9 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
16.9 MB · 16,897,894 B
First seen
2026-08-22 01:15 · 2 months ago
Last seen
2026-08-22 01:15 · 2 months ago
Last analysis
2026-09-03 18:08 · one month ago
Hashes
MD5
a629b59531a0780aeca540022274541f
Sha1
e2024640bbdabd720dcb2464de2e03e7dca2eb9d
Sha256
9f4e2dc6f2aeeb950936285e8e47f805d4e3d843e0912df08f49dc6e53bdf152
Sha384
d04402530cc180f04f814e22aa88a0ee800aafdbc469d72ea59828629e80693ad142485c547da6e58e24fca2480e226f
Sha512
e34af5ddbc6d3ca15096a36a9a8e27709c3262d238ac40b88b157fa755e50e7bb2775de865314152959d6333a3cdd3572ebacebd7b1fc099d69790e890721010
SSDeep
393216:oGylmOkvbt+C1CRwPsUto4GkF9fwYFSW48o4Q4Y3RsW8s:VylzU1ZsUTF9YYzrop4/3s
TLSH
74073314EB9420F5FC72D131CAB34BE1D9327846072066EB3B9079A75EF7295CA36722
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
19 malicious · 57 files
EXEa629b59531a0780aeca540022274541fT1027 · T1059 · T1059.001
Structure
RAROverlay_c5b9c6ad.binT1027 · T1059 · T1059.001
PS1OpenLink.ps1
EXEae_mixtwo.exe
VBSRunSilent.vbsT1027 · T1059 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
BINRunSilent.vbs.deobfuscated.vbs
SH[Command #0]
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 11
STICH kept: 2secondary ignored: 9
bin
8img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>arc:rar>scr:vbs~T1059~T1059.005>scr:bat
Shape
pe:exe>arc:rar>scr:vbs>scr:bat
malicious
4 nodes
Path
pe:exe>arc:rar>scr:vbs~T1059~T1059.005>scr:ps1~T1027~T1059.001
Shape
pe:exe>arc:rar>scr:vbs>scr:ps1
malicious
4 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_c5b9c6ad.bin (16417126 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"scriphuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"ko"
huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential