Deep Malware Analysis of b33de10ab81478434c8f0e9f78d64689 | md5: b33de10ab81478434c8f0e9f78d64689 | .Net | PE (Portable Executable) | Executable | Managed .NET | PE File Layout | SOS: 0.13 | Win 32 Exe | x86 | SOS: 0.27 | T1059.001 | T1027 | DeObfuscated | PowerShell | SOS: 0.00 | Batch Command | PowerShell Call | WScript.Shell | Scripting.FileSystemObject | VBScript | T1059.005 | Obfuscated | T1059 | COM Behavior Trace | SVG | PDB Path

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very low

MD5	b33de10ab81478434c8f0e9f78d64689
Sha1	7b38f3b9c04e1c554cd80d89dd94f26d1968bd67
Sha256	bb46bd0e15f13fcb3daac5751dc5616f9b3b7556ebcaee7c278d7f843008dd5f
Sha384	5b01c4c416a80afabbdc7c8058ffd05dcd1b4d371f77f8aba0ea0dc5a7ab836ab1329bddabd9e5d9a539f8e82af9cc83
Sha512	2f6dabbdfa40e26b16b4febe0d19925bc90bcb4734165036ce673e154164008cd4200d81061097570c85970fee9fa31916a93a02597ab7b24d431cf373d68486
SSDeep	196608:nq7Jz2s7HDrwjp5od1ypEII5N68PjdGimJ7b2dn1Tl2u:nwN2gHDGmKzEN68PjdyGdn1Eu
TLSH	C0963316CF585426DFA7D23A02A8A136E89C87F7AA53B32C0E385ED13C47AD11FDE115

PeID

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 4secondary ignored: 9

bin 5img 4

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>arc:zip>scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001

Shape pe:exe>arc:zip>scr:ps1>scr:vbs>scr:ps1

malicious 5 nodes

Path pe:exe>arc:zip>scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:bat

Shape pe:exe>arc:zip>scr:ps1>scr:bat

malicious 4 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	IndependentBooksSetup.exe
Full Name	IndependentBooksSetup.exe
EntryPoint	System.Void IndependentBooksSetup.Program::Main(System.String[])
Scope Name	IndependentBooksSetup.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	IndependentBooksSetup
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	30
Main Method	System.Void IndependentBooksSetup.Program::Main(System.String[])
Main IL Instruction Count	250
Main IL	ldc.i4.2 <null> newarr System.String stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr IndependentBooks stelem.ref <null> ldloc.s V_19 ldc.i4.1 <null> ldstr app_server stelem.ref <null> ldloc.s V_19 stloc.0 <null> ldloc.0 <null> stloc.s V_20 ldc.i4.0 <null> stloc.s V_21 br.s IL_006E: ldloc.s V_21 ldloc.s V_20 ldloc.s V_21 ldelem.ref <null> stloc.1 <null> ldloc.1 <null> call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String) stloc.s V_22 ldc.i4.0 <null> stloc.s V_23 br.s IL_005B: ldloc.s V_23 ldloc.s V_22 ldloc.s V_23 ldelem.ref <null> stloc.2 <null> ldloc.2 <null> callvirt System.Void System.Diagnostics.Process::Kill() ldloc.2 <null> ldc.i4 3000 callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32) pop <null> leave.s IL_0055: ldloc.s V_23 pop <null> leave.s IL_0055: ldloc.s V_23 ldloc.s V_23 ldc.i4.1 <null> add <null> stloc.s V_23 ldloc.s V_23 ldloc.s V_22 ldlen <null> conv.i4 <null> blt.s IL_0038: ldloc.s V_22 leave.s IL_0068: ldloc.s V_21 pop <null> leave.s IL_0068: ldloc.s V_21 ldloc.s V_21 ldc.i4.1 <null> add <null> stloc.s V_21 ldloc.s V_21 ldloc.s V_20 ldlen <null> conv.i4 <null> blt.s IL_0025: ldloc.s V_20 ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr Programs ldstr IndependentBooks call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.3 <null> ldloc.3 <null> call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_009C: ldloc.3 ldloc.3 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.3 <null> call System.String System.IO.Path::GetFullPath(System.String) stloc.s V_4 ldloc.s V_4 ldsfld System.Char System.IO.Path::DirectorySeparatorChar stloc.s V_24 ldloca.s V_24 call System.String System.Char::ToString() callvirt System.Boolean System.String::EndsWith(System.String) brtrue.s IL_00CE: ldc.i4.s 28 ldloc.s V_4 ldsfld System.Char System.IO.Path::DirectorySeparatorChar box System.Char call System.String System.String::Concat(System.Object,System.Object) stloc.s V_4 ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr IndependentBooks ldstr data call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.s V_5 ldloc.s V_5 call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_00F7: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_5 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.s V_6 ldloc.s V_6 ldstr Payload callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_7 ldloc.s V_7 brfalse IL_01C5: ldstr "Installation package is corrupted: payload stream not found." ldloc.s V_7 ldc.i4.0 <null> newobj System.Void System.IO.Compression.ZipArchive::.ctor(System.IO.Stream,System.IO.Compression.ZipArchiveMode) stloc.s V_8 ldloc.s V_8 callvirt System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry> System.IO.Compression.ZipArchive::get_Entries() callvirt System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry> System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry>::GetEnumerator() stloc.s V_25 br.s IL_01A0: ldloc.s V_25 ldloc.s V_25 callvirt System.IO.Compression.ZipArchiveEntry System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry>::get_Current() stloc.s V_9 ldloc.3 <null> ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_FullName() call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_10 ldloc.s V_10 call System.String System.IO.Path::GetFullPath(System.String) stloc.s V_11 ldloc.s V_11 ldloc.s V_4 ldc.i4.5 <null> callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison) brtrue.s IL_0171: ldloc.s V_9 ldstr Zip Slip path traversal blocked: ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_FullName() call System.String System.String::Concat(System.String,System.String) newobj System.Void System.InvalidOperationException::.ctor(System.String) throw <null> ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_Name() call System.Boolean System.String::IsNullOrEmpty(System.String) brfalse.s IL_0189: ldloc.s V_10 ldloc.s V_10 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> br.s IL_01A0: ldloc.s V_25 ldloc.s V_10 call System.String System.IO.Path::GetDirectoryName(System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.s V_9 ldloc.s V_10 ldc.i4.1 <null> call System.Void System.IO.Compression.ZipFileExtensions::ExtractToFile(System.IO.Compression.ZipArchiveEntry,System.String,System.Boolean) ldloc.s V_25 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() brtrue.s IL_012D: ldloc.s V_25 leave.s IL_01B7: leave.s IL_01D0 ldloc.s V_25 brfalse.s IL_01B6: endfinally ldloc.s V_25 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_01D0: leave.s IL_01DE ldloc.s V_8 brfalse.s IL_01C4: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldstr Installation package is corrupted: payload stream not found. newobj System.Void System.Exception::.ctor(System.String) throw <null> leave.s IL_01DE: ldc.i4.0 ldloc.s V_7 brfalse.s IL_01DD: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldc.i4.0 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.s V_12 ldloc.s V_12 ldstr Independent Books.lnk call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_13 ldloc.s V_13 ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr Independent Books - 1:1 Tally Prime Accounting Application call System.Void IndependentBooksSetup.Program::CreateShortcut(System.String,System.String,System.String,System.String) ldc.i4.2 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.s V_14 ldloc.s V_14 ldstr Independent Books call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_15 ldloc.s V_15 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.s V_15 ldstr Independent Books.lnk call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr Independent Books call System.Void IndependentBooksSetup.Program::CreateShortcut(System.String,System.String,System.String,System.String) ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_16 ldloc.s V_16 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0282: ldstr "Independent Books has been successfully installed!\n\nA shortcut has been created on your Desktop." newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_17 ldloc.s V_17 ldloc.s V_16 callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.s V_17 ldloc.3 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) ldloc.s V_17 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> ldstr Independent Books has been successfully installed! A shortcut has been created on your Desktop. ldstr Independent Books Setup ldc.i4.0 <null> ldc.i4.s 64 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_02BA: ret stloc.s V_18 ldstr Installation failed: ldloc.s V_18 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) ldstr Installation Error ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_02BA: ret ret <null>
Module Name	IndependentBooksSetup.exe
Full Name	IndependentBooksSetup.exe
EntryPoint	System.Void IndependentBooksSetup.Program::Main(System.String[])
Scope Name	IndependentBooksSetup.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	IndependentBooksSetup
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	30
Main Method	System.Void IndependentBooksSetup.Program::Main(System.String[])
Main IL Instruction Count	250
Main IL	ldc.i4.2 <null> newarr System.String stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr IndependentBooks stelem.ref <null> ldloc.s V_19 ldc.i4.1 <null> ldstr app_server stelem.ref <null> ldloc.s V_19 stloc.0 <null> ldloc.0 <null> stloc.s V_20 ldc.i4.0 <null> stloc.s V_21 br.s IL_006E: ldloc.s V_21 ldloc.s V_20 ldloc.s V_21 ldelem.ref <null> stloc.1 <null> ldloc.1 <null> call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String) stloc.s V_22 ldc.i4.0 <null> stloc.s V_23 br.s IL_005B: ldloc.s V_23 ldloc.s V_22 ldloc.s V_23 ldelem.ref <null> stloc.2 <null> ldloc.2 <null> callvirt System.Void System.Diagnostics.Process::Kill() ldloc.2 <null> ldc.i4 3000 callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32) pop <null> leave.s IL_0055: ldloc.s V_23 pop <null> leave.s IL_0055: ldloc.s V_23 ldloc.s V_23 ldc.i4.1 <null> add <null> stloc.s V_23 ldloc.s V_23 ldloc.s V_22 ldlen <null> conv.i4 <null> blt.s IL_0038: ldloc.s V_22 leave.s IL_0068: ldloc.s V_21 pop <null> leave.s IL_0068: ldloc.s V_21 ldloc.s V_21 ldc.i4.1 <null> add <null> stloc.s V_21 ldloc.s V_21 ldloc.s V_20 ldlen <null> conv.i4 <null> blt.s IL_0025: ldloc.s V_20 ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr Programs ldstr IndependentBooks call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.3 <null> ldloc.3 <null> call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_009C: ldloc.3 ldloc.3 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.3 <null> call System.String System.IO.Path::GetFullPath(System.String) stloc.s V_4 ldloc.s V_4 ldsfld System.Char System.IO.Path::DirectorySeparatorChar stloc.s V_24 ldloca.s V_24 call System.String System.Char::ToString() callvirt System.Boolean System.String::EndsWith(System.String) brtrue.s IL_00CE: ldc.i4.s 28 ldloc.s V_4 ldsfld System.Char System.IO.Path::DirectorySeparatorChar box System.Char call System.String System.String::Concat(System.Object,System.Object) stloc.s V_4 ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr IndependentBooks ldstr data call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.s V_5 ldloc.s V_5 call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_00F7: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_5 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.s V_6 ldloc.s V_6 ldstr Payload callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_7 ldloc.s V_7 brfalse IL_01C5: ldstr "Installation package is corrupted: payload stream not found." ldloc.s V_7 ldc.i4.0 <null> newobj System.Void System.IO.Compression.ZipArchive::.ctor(System.IO.Stream,System.IO.Compression.ZipArchiveMode) stloc.s V_8 ldloc.s V_8 callvirt System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry> System.IO.Compression.ZipArchive::get_Entries() callvirt System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry> System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry>::GetEnumerator() stloc.s V_25 br.s IL_01A0: ldloc.s V_25 ldloc.s V_25 callvirt System.IO.Compression.ZipArchiveEntry System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry>::get_Current() stloc.s V_9 ldloc.3 <null> ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_FullName() call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_10 ldloc.s V_10 call System.String System.IO.Path::GetFullPath(System.String) stloc.s V_11 ldloc.s V_11 ldloc.s V_4 ldc.i4.5 <null> callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison) brtrue.s IL_0171: ldloc.s V_9 ldstr Zip Slip path traversal blocked: ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_FullName() call System.String System.String::Concat(System.String,System.String) newobj System.Void System.InvalidOperationException::.ctor(System.String) throw <null> ldloc.s V_9 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_Name() call System.Boolean System.String::IsNullOrEmpty(System.String) brfalse.s IL_0189: ldloc.s V_10 ldloc.s V_10 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> br.s IL_01A0: ldloc.s V_25 ldloc.s V_10 call System.String System.IO.Path::GetDirectoryName(System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.s V_9 ldloc.s V_10 ldc.i4.1 <null> call System.Void System.IO.Compression.ZipFileExtensions::ExtractToFile(System.IO.Compression.ZipArchiveEntry,System.String,System.Boolean) ldloc.s V_25 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() brtrue.s IL_012D: ldloc.s V_25 leave.s IL_01B7: leave.s IL_01D0 ldloc.s V_25 brfalse.s IL_01B6: endfinally ldloc.s V_25 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_01D0: leave.s IL_01DE ldloc.s V_8 brfalse.s IL_01C4: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldstr Installation package is corrupted: payload stream not found. newobj System.Void System.Exception::.ctor(System.String) throw <null> leave.s IL_01DE: ldc.i4.0 ldloc.s V_7 brfalse.s IL_01DD: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldc.i4.0 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.s V_12 ldloc.s V_12 ldstr Independent Books.lnk call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_13 ldloc.s V_13 ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr Independent Books - 1:1 Tally Prime Accounting Application call System.Void IndependentBooksSetup.Program::CreateShortcut(System.String,System.String,System.String,System.String) ldc.i4.2 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.s V_14 ldloc.s V_14 ldstr Independent Books call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_15 ldloc.s V_15 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.s V_15 ldstr Independent Books.lnk call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) ldloc.3 <null> ldstr Independent Books call System.Void IndependentBooksSetup.Program::CreateShortcut(System.String,System.String,System.String,System.String) ldloc.3 <null> ldstr IndependentBooks.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_16 ldloc.s V_16 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0282: ldstr "Independent Books has been successfully installed!\n\nA shortcut has been created on your Desktop." newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_17 ldloc.s V_17 ldloc.s V_16 callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.s V_17 ldloc.3 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) ldloc.s V_17 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> ldstr Independent Books has been successfully installed! A shortcut has been created on your Desktop. ldstr Independent Books Setup ldc.i4.0 <null> ldc.i4.s 64 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_02BA: ret stloc.s V_18 ldstr Installation failed: ldloc.s V_18 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) ldstr Installation Error ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_02BA: ret ret <null>

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

applichuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

applichuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential