Malicious
a861cd4629c460f3599fcba6230bef36
PE Executable
MD5: a861cd4629c460f3599fcba6230bef36
Size: 12.47 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Encoded VBScript file
Size
12.47 MB · 12,467,994 B
First seen
2026-08-27 06:30 · 2 months ago
Last seen
2026-08-27 06:30 · 2 months ago
Last analysis
2026-08-27 06:30 · 2 months ago
Hashes
MD5
a861cd4629c460f3599fcba6230bef36
Sha1
0db2b7cdb06a84787ab09fbb3a0627042800b61e
Sha256
88c8714de236000365062d3d42f158f394c6f1bbfca7197f9140ceb6dc6e8c70
Sha384
e7c3a7a6a9ca27118313671806e00091d98bb5056aa85649687c3d5feb5029d867a22179e24058ff660ff88840559c84
Sha512
ec01f6339a5c5fa98a04fec190dd10f2df92f9b4ca14946ecc746d0adbeb7a67e902fc01578ae785916d2696f56ab1cb7ca8672f2d2beff588c799878f089000
SSDeep
98304:yWl2X8KwwfxwNjtkTwpPK++tAZ/Fza/JmUMMJ06G:Dl2sKwOK8cpyjtAN6Aph
TLSH
51C6F14697618E33C2AA3F7185D7001E46B0D6623522EF1B773F18E1AC4A3718F666F6
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
4 malicious · 39 files
EXEa861cd4629c460f3599fcba6230bef36T1059.005
Structure
VBSOverlay_0be623cc.bin
EXEMsSurrogateProvidersaves.exe
Structure
BINOverlay_37a4a273.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINr75342jHhdqht5hPFI.hWvsalLt2htvBrMWYp
BINu9V6ikwXVXTUVHHXpl.Eyw7WLJSc00BLUwDTj
BINk677u8VaRl8OASYr3X.x4ueJMWIyhgfWNpEWB
BINvJDsD99KD9NqAyL5Nt.KFednafZBKrcZNCG7F
BINJePRQbh5Qe4ku3civv.qplBu7gFguXyfSr44i
BIN3ZaGHaROc3gHjwfacx.v3VJwOGBhPdUA8R3RE
VBSkjvd7QUUdfA43NzogE2HY6rQ9nAIuNZaoQwskp0zuskO.vbe
BATPlGXNhy.bat
BINResources
BINPNG
BINID:0065
IMGID:1033
IMGID:1033-preview.png
BINID:0066
IMGID:1033
IMGID:1033-preview.png
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINRT_DIALOG
BINID:0000
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0064
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
VBSa861cd4629c460f3599fcba6230bef36.decoded.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
7 / 7
Path
pe:exe>scr:vbe>pe:exe>pe:rsrc>bin
Shape
pe:exe>scr:vbe>pe:exe>pe:rsrc>bin
malicious
5 nodes
Path
pe:exe>scr:vbe>pe:exe>bin
Shape
pe:exe>scr:vbe>pe:exe>bin
malicious
4 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_0be623cc.bin (12146970 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |
4 malicious · 39 files
EXEa861cd4629c460f3599fcba6230bef36T1059.005
Structure
VBSOverlay_0be623cc.bin
EXEMsSurrogateProvidersaves.exe
Structure
BINOverlay_37a4a273.bin
BINResources
BIN.Net Resources
VBSkjvd7QUUdfA43NzogE2HY6rQ9nAIuNZaoQwskp0zuskO.vbe
BATPlGXNhy.bat
BINResources
VBSa861cd4629c460f3599fcba6230bef36.decoded.vbsT1059.005
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account