Malicious
AutoIt Compiled Script
MD5: b67a1b0883d31f6243ce8f25d4d1959e
Size: 1.55 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
AutoIt Compiled Script
Size
1.55 MB · 1,548,288 B
First seen
2026-08-19 14:01 · 2 months ago
Last seen
2026-08-19 14:01 · 2 months ago
Last analysis
2026-08-19 14:02 · 2 months ago
Hashes
MD5
b67a1b0883d31f6243ce8f25d4d1959e
Sha1
a7215021a12841828e06633ececf5cf9e99899d2
Sha256
d3840bcd452fbd7df0083393d79e5848192231195a7242a018c0b8a991e3d3f8
Sha384
53ba4066547ef2cc2075028ea1a9d2e9393343599cc9970bf4e5f7ca99c0a3f53da64f7c0cfe159f3d66e45e1172e9bb
Sha512
a96130758406e7b07b587f90018258fe6fe5a99c4c3be9ae1e527c7bbfeb887770f0305fa333b300456d429ecd13ddaa1dd4038908072617e7b6071b0f4d3938
SSDeep
24576:WANblNSdUTLJyokA7VkgsUY3BvfI0WfahXyeByehS+UKLRtyZpz:1o6LA87VpsJ3BvAxfKXygTc
TLSH
08652302AAE50446E4A6477448BBD2BB59747C92CB39A2CF27C91D0F7E22FD57832317
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)
4 malicious · 68 files
A3Xb67a1b0883d31f6243ce8f25d4d1959e
Structure
BINResources
A3XYr.a3x
A3XautF525.tmp.tok
A3X[Cleaned].au3
A3XAutoIt3.exe
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 7
STICH kept: 1secondary ignored: 6
bin
4img
2Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:autoit>pe:autoit
Shape
pe:exe>pe:autoit>pe:autoit
malicious
3 nodes
| Name | Value |
|---|---|
| Info | PDB Path: wextract.pdb |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential