Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b07f16a3b524017d20d360823c09b956
Sha1 f680fbbf487f61c9bd231e48f83a9e1c092ceb6a
Sha256 4e5b2ae91379b8069c04c6639bb0bca5ddea0dde567bea8cb9bc9822b9cdda0d
Sha384 9010953b26f91d9e96abf654e4f4c5e68474a177af6352ccfa9dfe573cf11165cace814c79df1bd9f8214933960847a9
Sha512 35478fef67de169e32d7daffa3ae12a92b44d0953bf4607382816756bdd7d15ba42fb55afcc9b08d2bc01de1132a3a07f37ac7a82ccdcb9861ad1b6842d771d5
SSDeep 24576:iw+tSVHEX47Z8E/X0xZ0Id+7IsJSa/aqGK1CIOJC1+0sPiB4HM:n+ekXkQvPd+3JS1+1CQpbB4s
TLSH BF3523C1314084D7FFF395791867CF9BD4A49D5086B4A34B03E13B8AA4F28D7BB2A625
PeID
Microsoft Visual C++ v6.0 DLL
b07f16a3b524017d20d360823c09b956
Malicious
[NSIS Installer] @ #0000D808
Malicious
Setup.vbs
Malicious
[PowerShell Command]
Malicious
[Command #0]
Malicious
[Command #1]
Malicious
[Command #2]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
.runner.ps1
file1_info.json
~run.bat
32jP3efCND0U.part-jadoo
HANRUPqDbLSV.part-jadoo
VB7Xlik3Suo2.part-jadoo
kHyhuRdlc5Xs.part-jadoo
xWPo0kFlBgZO.part-jadoo
[SETUP_DECOMPILED.NSI]
Overlay_07fdfc8a.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.ndata
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:1033-preview.png
ID:0004
ID:1033
RT_DIALOG
ID:0069
ID:1033
ID:006A
ID:1033
ID:006F
ID:1033
RT_GROUP_CURSOR4
ID:0067
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_07fdfc8a.bin (1044745 bytes)
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
" varhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"" huhuhuhuhuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
" varhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"" [Uhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
& [Unmhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b07f16a3b524017d20d360823c09b956
Malicious
[NSIS Installer] @ #0000D808
Malicious
Setup.vbs
Malicious
[PowerShell Command]
Malicious
[Command #0]
Malicious
[Command #1]
Malicious
[Command #2]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
.runner.ps1
file1_info.json
~run.bat
32jP3efCND0U.part-jadoo
HANRUPqDbLSV.part-jadoo
VB7Xlik3Suo2.part-jadoo
kHyhuRdlc5Xs.part-jadoo
xWPo0kFlBgZO.part-jadoo
[SETUP_DECOMPILED.NSI]
Overlay_07fdfc8a.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.ndata
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:1033-preview.png
ID:0004
ID:1033
RT_DIALOG
ID:0069
ID:1033
ID:006A
ID:1033
ID:006F
ID:1033
RT_GROUP_CURSOR4
ID:0067
ID:1033
RT_MANIFEST
ID:0001
ID:1033
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
b07f16a3b524017d20d360823c09b956 › [NSIS Installer] @ #0000D808 › Setup.vbs › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
" varhuhuhuhuhuhuhuhuhuhuhu
b07f16a3b524017d20d360823c09b956 › [NSIS Installer] @ #0000D808 › Setup.vbs › Setup.vbs.deobfuscated.vbs › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
b07f16a3b524017d20d360823c09b956 › [NSIS Installer] @ #0000D808 › Setup.vbs › Setup.vbs.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"" huhuhuhuhuhuhuhuhuhuhu
b07f16a3b524017d20d360823c09b956 › [NSIS Installer] @ #0000D808 › Setup.vbs › Setup.vbs.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
b07f16a3b524017d20d360823c09b956 › [NSIS Installer] @ #0000D808 › kHyhuRdlc5Xs.part-jadoo
Deobfuscated PowerShell UNKNWOWNmalicious
" varhuhuhuhuhuhuhuhuhuhuhu
b07f16a3b524017d20d360823c09b956 › [NSIS Installer] @ #0000D808 › Setup.vbs › Setup.vbs.deobfuscated.vbs › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
b07f16a3b524017d20d360823c09b956 › [NSIS Installer] @ #0000D808 › Setup.vbs › Setup.vbs.deobfuscated.vbs › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"" [Uhuhuhuhuhuhuhuhuhuhuhu
b07f16a3b524017d20d360823c09b956 › [NSIS Installer] @ #0000D808 › Setup.vbs › Setup.vbs.deobfuscated.vbs › [PowerShell Command] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
& [Unmhuhuhuhuhuhuhuhuhuhuhu
b07f16a3b524017d20d360823c09b956 › [NSIS Installer] @ #0000D808 › Setup.vbs › Setup.vbs.deobfuscated.vbs › [Command #2] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙