b33de10ab81478434c8f0e9f78d64689

PE Executable

MD5: b33de10ab81478434c8f0e9f78d64689

Size: 8.99 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	b33de10ab81478434c8f0e9f78d64689
Sha1	7b38f3b9c04e1c554cd80d89dd94f26d1968bd67
Sha256	bb46bd0e15f13fcb3daac5751dc5616f9b3b7556ebcaee7c278d7f843008dd5f
Sha384	5b01c4c416a80afabbdc7c8058ffd05dcd1b4d371f77f8aba0ea0dc5a7ab836ab1329bddabd9e5d9a539f8e82af9cc83
Sha512	2f6dabbdfa40e26b16b4febe0d19925bc90bcb4734165036ce673e154164008cd4200d81061097570c85970fee9fa31916a93a02597ab7b24d431cf373d68486
SSDeep	196608:nq7Jz2s7HDrwjp5od1ypEII5N68PjdGimJ7b2dn1Tl2u:nwN2gHDGmKzEN68PjdyGdn1Eu
TLSH	C0963316CF585426DFA7D23A02A8A136E89C87F7AA53B32C0E385ED13C47AD11FDE115

PeID

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 4secondary ignored: 9

bin 5img 4

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>arc:zip>scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001

Shape pe:exe>arc:zip>scr:ps1>scr:vbs>scr:ps1

malicious 5 nodes

Path pe:exe>arc:zip>scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:bat

Shape pe:exe>arc:zip>scr:ps1>scr:bat

malicious 4 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	IndependentBooksSetup.exe
Full Name	IndependentBooksSetup.exe
EntryPoint	System.Void IndependentBooksSetup.Program::Main(System.String[])
Scope Name	IndependentBooksSetup.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	IndependentBooksSetup
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	30
Main Method	System.Void IndependentBooksSetup.Program::Main(System.String[])
Main IL Instruction Count	250
Main IL	ldc.i4.2 <null> newarr System.String stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr IndependentBooks stelem.ref <null> ldloc.s V_19 ldc.i4.1 <null> ldstr app_server stelem.ref <null> ldloc.s V_19 stloc.0 <null> ldloc.0 <null> stloc.s V_20 ldc.i4.0 <null> stloc.s V_21 br.s IL_006E: ldloc.s V_21 ldloc.s V_20 ldloc.s V_21 ldelem.ref <null> stloc.1 <null> ldloc.1 <null> call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String) stloc.s V_22 ldc.i4.0 <null> stloc.s V_23 br.s IL_005B: ldloc.s V_23 ldloc.s V_22 ldloc.s V_23 ldelem.ref <null> stloc.2 <null> ldloc.2 <null> callvirt System.Void System.Diagnostics.Process::Kill() ldloc.2 <null> ldc.i4 3000 callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32) pop <null> leave.s IL_0055: ldloc.s V_23 pop <null> leave.s IL_0055: ldloc.s V_23 ldloc.s V_23 ldc.i4.1 <null> add <null> stloc.s V_23 ldloc.s V_23 ldloc.s V_22 ldlen <null> conv.i4 <null> blt.s IL_0038: ldloc.s V_22 leave.s IL_0068: ldloc.s V_21 pop <null> leave.s IL_0068: ldloc.s V_21 ldloc.s V_21 ldc.i4.1 <null> add <null> stloc.s V_21 ldloc.s V_21 ldloc.s V_20 ldlen <null> conv.i4 <null> blt.s IL_0025: ldloc.s V_20 ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr Programs ldstr IndependentBooks call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.3 <null> ldloc.3 <null> call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_009C: ldloc.3 ldloc.3 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.3 <null> call System.String System.IO.Path::GetFullPath(System.String) stloc.s V_4 ldloc.s V_4 ldsfld System.Char System.IO.Path::DirectorySeparatorChar stloc.s V_24 ldloca.s V_24 call System.String System.Char::ToString() callvirt System.Boolean System.String::EndsWith(System.String) brtrue.s IL_00CE: ldc.i4.s 28 ldloc.s V_4 ldsfld System.Char System.IO.Path::DirectorySeparatorChar box System.Char call System.String System.String::Concat(System.Object,System.Object) stloc.s V_4 ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr IndependentBooks ldstr data call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.s V_5 ldloc.s V_5 call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_00F7: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_5 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.s V_6 ldloc.s V_6 ldstr Payload callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_7 ldloc.s V_7 brfalse IL_01C5: ldstr "Installation package is corrupted: payload stream not found." ldloc.s V_7 ldc.i4.0 <null> newobj System.Void System.IO.Compression.ZipArchive::.ctor(System.IO.Stream,System.IO.Compression.ZipArchiveMode) stloc.s V_8 ldloc.s V_8 callvirt System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry> System.IO.Compression.ZipArchive::get_Entries() callvirt System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry> System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry>::GetEnumerator() stloc.s V_25 br.s IL_01A0: ldloc.s V_25 ldloc.s V_25 callvirt System.IO.Compression.ZipArchiveEntry System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry>::get_Current() stloc.s V_9 ldloc.3 <null> ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_FullName() call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_10 ldloc.s V_10 call System.String System.IO.Path::GetFullPath(System.String) stloc.s V_11 ldloc.s V_11 ldloc.s V_4 ldc.i4.5 <null> callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison) brtrue.s IL_0171: ldloc.s V_9 ldstr Zip Slip path traversal blocked: ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_FullName() call System.String System.String::Concat(System.String,System.String) newobj System.Void System.InvalidOperationException::.ctor(System.String) throw <null> ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_Name() call System.Boolean System.String::IsNullOrEmpty(System.String) brfalse.s IL_0189: ldloc.s V_10 ldloc.s V_10 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> br.s IL_01A0: ldloc.s V_25 ldloc.s V_10 call System.String System.IO.Path::GetDirectoryName(System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.s V_9 ldloc.s V_10 ldc.i4.1 <null> call System.Void System.IO.Compression.ZipFileExtensions::ExtractToFile(System.IO.Compression.ZipArchiveEntry,System.String,System.Boolean) ldloc.s V_25 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() brtrue.s IL_012D: ldloc.s V_25 leave.s IL_01B7: leave.s IL_01D0 ldloc.s V_25 brfalse.s IL_01B6: endfinally ldloc.s V_25 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_01D0: leave.s IL_01DE ldloc.s V_8 brfalse.s IL_01C4: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldstr Installation package is corrupted: payload stream not found. newobj System.Void System.Exception::.ctor(System.String) throw <null> leave.s IL_01DE: ldc.i4.0 ldloc.s V_7 brfalse.s IL_01DD: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldc.i4.0 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.s V_12 ldloc.s V_12 ldstr Independent Books.lnk call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_13 ldloc.s V_13 ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr Independent Books - 1:1 Tally Prime Accounting Application call System.Void IndependentBooksSetup.Program::CreateShortcut(System.String,System.String,System.String,System.String) ldc.i4.2 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.s V_14 ldloc.s V_14 ldstr Independent Books call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_15 ldloc.s V_15 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.s V_15 ldstr Independent Books.lnk call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr Independent Books call System.Void IndependentBooksSetup.Program::CreateShortcut(System.String,System.String,System.String,System.String) ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_16 ldloc.s V_16 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0282: ldstr "Independent Books has been successfully installed!\n\nA shortcut has been created on your Desktop." newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_17 ldloc.s V_17 ldloc.s V_16 callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.s V_17 ldloc.3 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) ldloc.s V_17 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> ldstr Independent Books has been successfully installed! A shortcut has been created on your Desktop. ldstr Independent Books Setup ldc.i4.0 <null> ldc.i4.s 64 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_02BA: ret stloc.s V_18 ldstr Installation failed: ldloc.s V_18 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) ldstr Installation Error ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_02BA: ret ret <null>
Module Name	IndependentBooksSetup.exe
Full Name	IndependentBooksSetup.exe
EntryPoint	System.Void IndependentBooksSetup.Program::Main(System.String[])
Scope Name	IndependentBooksSetup.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	IndependentBooksSetup
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	30
Main Method	System.Void IndependentBooksSetup.Program::Main(System.String[])
Main IL Instruction Count	250
Main IL	ldc.i4.2 <null> newarr System.String stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr IndependentBooks stelem.ref <null> ldloc.s V_19 ldc.i4.1 <null> ldstr app_server stelem.ref <null> ldloc.s V_19 stloc.0 <null> ldloc.0 <null> stloc.s V_20 ldc.i4.0 <null> stloc.s V_21 br.s IL_006E: ldloc.s V_21 ldloc.s V_20 ldloc.s V_21 ldelem.ref <null> stloc.1 <null> ldloc.1 <null> call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String) stloc.s V_22 ldc.i4.0 <null> stloc.s V_23 br.s IL_005B: ldloc.s V_23 ldloc.s V_22 ldloc.s V_23 ldelem.ref <null> stloc.2 <null> ldloc.2 <null> callvirt System.Void System.Diagnostics.Process::Kill() ldloc.2 <null> ldc.i4 3000 callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32) pop <null> leave.s IL_0055: ldloc.s V_23 pop <null> leave.s IL_0055: ldloc.s V_23 ldloc.s V_23 ldc.i4.1 <null> add <null> stloc.s V_23 ldloc.s V_23 ldloc.s V_22 ldlen <null> conv.i4 <null> blt.s IL_0038: ldloc.s V_22 leave.s IL_0068: ldloc.s V_21 pop <null> leave.s IL_0068: ldloc.s V_21 ldloc.s V_21 ldc.i4.1 <null> add <null> stloc.s V_21 ldloc.s V_21 ldloc.s V_20 ldlen <null> conv.i4 <null> blt.s IL_0025: ldloc.s V_20 ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr Programs ldstr IndependentBooks call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.3 <null> ldloc.3 <null> call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_009C: ldloc.3 ldloc.3 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.3 <null> call System.String System.IO.Path::GetFullPath(System.String) stloc.s V_4 ldloc.s V_4 ldsfld System.Char System.IO.Path::DirectorySeparatorChar stloc.s V_24 ldloca.s V_24 call System.String System.Char::ToString() callvirt System.Boolean System.String::EndsWith(System.String) brtrue.s IL_00CE: ldc.i4.s 28 ldloc.s V_4 ldsfld System.Char System.IO.Path::DirectorySeparatorChar box System.Char call System.String System.String::Concat(System.Object,System.Object) stloc.s V_4 ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr IndependentBooks ldstr data call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.s V_5 ldloc.s V_5 call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_00F7: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_5 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.s V_6 ldloc.s V_6 ldstr Payload callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_7 ldloc.s V_7 brfalse IL_01C5: ldstr "Installation package is corrupted: payload stream not found." ldloc.s V_7 ldc.i4.0 <null> newobj System.Void System.IO.Compression.ZipArchive::.ctor(System.IO.Stream,System.IO.Compression.ZipArchiveMode) stloc.s V_8 ldloc.s V_8 callvirt System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry> System.IO.Compression.ZipArchive::get_Entries() callvirt System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry> System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry>::GetEnumerator() stloc.s V_25 br.s IL_01A0: ldloc.s V_25 ldloc.s V_25 callvirt System.IO.Compression.ZipArchiveEntry System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry>::get_Current() stloc.s V_9 ldloc.3 <null> ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_FullName() call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_10 ldloc.s V_10 call System.String System.IO.Path::GetFullPath(System.String) stloc.s V_11 ldloc.s V_11 ldloc.s V_4 ldc.i4.5 <null> callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison) brtrue.s IL_0171: ldloc.s V_9 ldstr Zip Slip path traversal blocked: ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_FullName() call System.String System.String::Concat(System.String,System.String) newobj System.Void System.InvalidOperationException::.ctor(System.String) throw <null> ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_Name() call System.Boolean System.String::IsNullOrEmpty(System.String) brfalse.s IL_0189: ldloc.s V_10 ldloc.s V_10 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> br.s IL_01A0: ldloc.s V_25 ldloc.s V_10 call System.String System.IO.Path::GetDirectoryName(System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.s V_9 ldloc.s V_10 ldc.i4.1 <null> call System.Void System.IO.Compression.ZipFileExtensions::ExtractToFile(System.IO.Compression.ZipArchiveEntry,System.String,System.Boolean) ldloc.s V_25 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() brtrue.s IL_012D: ldloc.s V_25 leave.s IL_01B7: leave.s IL_01D0 ldloc.s V_25 brfalse.s IL_01B6: endfinally ldloc.s V_25 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_01D0: leave.s IL_01DE ldloc.s V_8 brfalse.s IL_01C4: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldstr Installation package is corrupted: payload stream not found. newobj System.Void System.Exception::.ctor(System.String) throw <null> leave.s IL_01DE: ldc.i4.0 ldloc.s V_7 brfalse.s IL_01DD: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldc.i4.0 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.s V_12 ldloc.s V_12 ldstr Independent Books.lnk call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_13 ldloc.s V_13 ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr Independent Books - 1:1 Tally Prime Accounting Application call System.Void IndependentBooksSetup.Program::CreateShortcut(System.String,System.String,System.String,System.String) ldc.i4.2 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.s V_14 ldloc.s V_14 ldstr Independent Books call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_15 ldloc.s V_15 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.s V_15 ldstr Independent Books.lnk call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr Independent Books call System.Void IndependentBooksSetup.Program::CreateShortcut(System.String,System.String,System.String,System.String) ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_16 ldloc.s V_16 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0282: ldstr "Independent Books has been successfully installed!\n\nA shortcut has been created on your Desktop." newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_17 ldloc.s V_17 ldloc.s V_16 callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.s V_17 ldloc.3 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) ldloc.s V_17 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> ldstr Independent Books has been successfully installed! A shortcut has been created on your Desktop. ldstr Independent Books Setup ldc.i4.0 <null> ldc.i4.s 64 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_02BA: ret stloc.s V_18 ldstr Installation failed: ldloc.s V_18 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) ldstr Installation Error ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_02BA: ret ret <null>

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

applichuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

applichuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

b33de10ab81478434c8f0e9f78d64689 › .Net Resources › Payload › Launch.vbs

Deobfuscated PowerShell UNKNWOWNmalicious

applichuhuhuhuhuhuhuhuhuhuhu

b33de10ab81478434c8f0e9f78d64689 › .Net Resources › Payload › Launch.vbs › [PowerShell Command]

Deobfuscated PowerShell UNKNWOWNmalicious

applichuhuhuhuhuhuhuhuhuhuhu

b33de10ab81478434c8f0e9f78d64689 › .Net Resources › Payload › Launch.vbs › Launch.vbs.deobfuscated.vbs › [PowerShell Command]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.