Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b684e5adedea69831b13c66e7c1636f2
Sha1 b7c4de5958b89cc3ca150d3e3225ff5a8d147902
Sha256 c006997765a787324f0ad62db2a591dc3c545497343b4f1828c21d7a79f16634
Sha384 b4efcb59f3195be75398284ef7a348fc3b22ad67814d12106a571b00ba4889d3016da3e0d6f104b7071bb30be070a2e0
Sha512 c97e519a518c339b0b0b5a7fc09ca54b065daacfa852a9d9b354e0e8e69a2cffe90a1f55cab2475c5c2d81262176830643caa930aac67c9006e98c2cd93b47bd
SSDeep 49152:0ZsU8rucYFRyXDNJCTRb1OWugPpAgIGONcjqg4o3o8GpjgLLW:0b8r0aGR4WuSx9ccug4oTGpL
TLSH E2D53300F419858C8F8F7ABDC96B90DD274FB5DD5BB350E3D2213648AFB201B9B68685
b684e5adedea69831b13c66e7c1636f2
Malicious
_FactHKJCT20281-044978.Proc30465.vbs
Malicious
~
llqpu2.xml
[Authenticode]_e407a7b2.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
xmbm1.xml
[Authenticode]_86d02839.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
zhmj
qily
mdfc
geluc
hcfces2.pdf
Text (Preview)
Page #1
Page #2
#Stream obj 6 0
#Stream obj 23 0
#Stream obj 2 0
#Stream obj 32 0
#Stream obj 51 0
#Stream obj 20 0
#Stream obj 21 0
#Stream obj 22 0
#Stream obj 24 0
#Stream obj 25 0
#Stream obj 26 0
#Stream obj 27 0
#Stream obj 28 0
#Stream obj 29 0
#Stream obj 30 0
#Stream obj 31 0
#Stream obj 5 0
#Stream obj 7 0
#Stream obj 8 0
#Stream obj 9 0
ptqs1.pdf
Text (Preview)
Page #1
#Stream obj 4 0
#Stream obj 6 0
#Stream obj 6 0-preview.png
#Stream obj 5 0
#Stream obj 5 0.exif
#Stream obj 5 0-preview.png
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 8 STICH kept: 1secondary ignored: 7
bin 5img 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>scr:vbs~T1027~T1059~T1059.005
Shape arc:zip>scr:vbs
malicious 2 nodes
Name Value
Version
1.3
Version
1.7
CreationDate
D:20210929131942-03'00'
Creator
Crystal Reports
ModifiedDate
D:20210929131942-03'00'
Producer
Powered By Crystal
/CreationDate
D:20210929131942-03'00'
/Creator
Crystal Reports
/ModDate
D:20210929131942-03'00'
/Producer
Powered By Crystal
Command (COM trace) #1 UNKNWOWNmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1 PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #2 PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b684e5adedea69831b13c66e7c1636f2
Malicious
_FactHKJCT20281-044978.Proc30465.vbs
Malicious
~
llqpu2.xml
[Authenticode]_e407a7b2.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
xmbm1.xml
[Authenticode]_86d02839.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
zhmj
qily
mdfc
geluc
hcfces2.pdf
Text (Preview)
Page #1
Page #2
#Stream obj 6 0
#Stream obj 23 0
#Stream obj 2 0
#Stream obj 32 0
#Stream obj 51 0
#Stream obj 20 0
#Stream obj 21 0
#Stream obj 22 0
#Stream obj 24 0
#Stream obj 25 0
#Stream obj 26 0
#Stream obj 27 0
#Stream obj 28 0
#Stream obj 29 0
#Stream obj 30 0
#Stream obj 31 0
#Stream obj 5 0
#Stream obj 7 0
#Stream obj 8 0
#Stream obj 9 0
ptqs1.pdf
Text (Preview)
Page #1
#Stream obj 4 0
#Stream obj 6 0
#Stream obj 6 0-preview.png
#Stream obj 5 0
#Stream obj 5 0.exif
#Stream obj 5 0-preview.png
Structure
No malware configuration was found at this point.
Command (COM trace) #1 UNKNWOWNmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
b684e5adedea69831b13c66e7c1636f2 › _FactHKJCT20281-044978.Proc30465.vbs
Dropped path (COM trace) #1 PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
b684e5adedea69831b13c66e7c1636f2 › _FactHKJCT20281-044978.Proc30465.vbs
Dropped path (COM trace) #2 PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
b684e5adedea69831b13c66e7c1636f2 › _FactHKJCT20281-044978.Proc30465.vbs
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
b684e5adedea69831b13c66e7c1636f2 › _FactHKJCT20281-044978.Proc30465.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙