Suspicious
Suspect

a7e7c0a98f8e5dca6f1c15b5956294a6

Disk Image
MD5: a7e7c0a98f8e5dca6f1c15b5956294a6
Size: 1.14 MB

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a7e7c0a98f8e5dca6f1c15b5956294a6
Sha1 923f08913c8c05b32c4f89e3395b714a677d4bb7
Sha256 beed089163efdba28ff4e0792272c79708c3b471be85f39bc1b5b8be2ff479cd
Sha384 632a9e8b25c99101095ee4982801b8b5fa9b1cd2eae638136df73641a5b822180138bd03c0291c3c9aee0b8a9cb8a921
Sha512 3195fc5db7e77b36a1b47cd32fab06dfed046ef10c7c65978e7cadbef91d6ae599dc834378f41376aebfb2c29c4053969bc563207c08917945fde9def20dc614
SSDeep 12288:AfYPo/gfgMUCPvcU8bLqd3sqItJSfgpf6DtdzfW9:AfYPo/cgIH/8/qdGTpat9
TLSH 6E351312EBE0D49AD4590533CD7263F3CAA9BD61D3640A87778C7E487F723429A1B381
[NSIS Installer] @ #00029408
Paralyzant
Hoslagte.ini
Bodsvandringer
Rudolf.jpg
Rudolf.jpg-preview.png
metalarbejderen.vas
uopskaarede.ini
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.reloc
[SETUP_DECOMPILED.NSI]
[Authenticode]_b033fe56.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.ndata
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
RT_DIALOG
ID:0069
ID:1033
ID:006A
ID:1033
ID:006F
ID:1033
RT_GROUP_CURSOR4
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3
bin 2img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path img:disk>pe:exe>pe:dll
Shape img:disk>pe:exe>pe:dll
3 nodes
Name Value
ISO
DiskImage extraction mode: DiscUtils (ISO)
[NSIS Installer] @ #00029408
Paralyzant
Hoslagte.ini
Bodsvandringer
Rudolf.jpg
Rudolf.jpg-preview.png
metalarbejderen.vas
uopskaarede.ini
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.reloc
[SETUP_DECOMPILED.NSI]
[Authenticode]_b033fe56.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.ndata
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
RT_DIALOG
ID:0069
ID:1033
ID:006A
ID:1033
ID:006F
ID:1033
RT_GROUP_CURSOR4
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙