Malicious
PE Executable
MD5: b4a65477542b3799b10940edaca3067e
Size: 3.76 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | b4a65477542b3799b10940edaca3067e |
| Sha1 | 61c777c5071c8264412fe317f30e5c493ac7cc76 |
| Sha256 | a0c5ebaa47f0cf3d8cd695d66b8c5e5561afd30da1b2f4d73f3736dca35efba7 |
| Sha384 | da7e5526e6f006b129efb3e9d1dd78d9b99b09ce286ccca3794b209f8152467b9392137012604a3a16c9284b658fbafe |
| Sha512 | 3824075f54eff5983964e7a63fea3413a4eea73ddc8bf8f01596ad2b326f439584ddc75750135ea915e8d07d999e4605505e2ae32239a7ca04cf841d09a46279 |
| SSDeep | 98304:7lg6xQaszjML+D3srjGMgTGC1QV6hybf4oKb/2:5xyzjF3snHSb1W6h+f4Db/ |
| TLSH | 4E06330BF7AC3A15D3654BB116824533D631B8F58BC183BF479EFDA89E531E1A13848A |
PeID
Microsoft Visual C++ 8.0 (DLL)UPolyX 0.3 -> delikon
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 4
STICH kept: 2secondary ignored: 2
bin
1img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>scr:ps1~T1027~T1059.001
Shape
pe:exe>scr:ps1
malicious
2 nodes
Path
pe:exe>pe:exe
Shape
pe:exe>pe:exe
2 nodes
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | PDB Path: wextract.pdb |
Deobfuscated PowerShell
UNKNWOWNmalicious
??????huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential