Malicious
Malicious

Game.msi

MS Office Document
MD5: bcc1a05ac1ee37883bbefd13683b6047
Size: 13.43 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 bcc1a05ac1ee37883bbefd13683b6047
Sha1 ab740c71f91e6a7fa6785b9884069f0b2e97d5cd
Sha256 325a6f283587b73d5ff6e9b3f1d82507bfb9ad96d0b31660abdb39792646dc84
Sha384 f13b1e7b72b36d002d3976e69a54ebc6db094fefff5b3c0ea2974e2c275c6d1f6b4d190e4bb76649665f9da133bebbfb
Sha512 e3979b8dab6c0610ce1871a91229359f831975ba468ab84e7e350bd67354ecc9ba6036fe711e498043f3ce73b97b38f9116ed3d8b97430fefec42f8d2c6f3c0f
SSDeep 393216:9xsh1Ud0YYbPuCebZ9f8Ar7e6FoBKZpYDxZW:9Ohq6YUGZZVr7e6/r
TLSH FED633C0ED54BF19E4FB94B34E4DD3647B61FD35BA04E424FEA83B291A32BA140A61C4
Root Entry
䡀䌏䈯
䡀䈖䌧䠤
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䕙䓲䕨䜷
filA3E01361C19F9119AA61D13BD2337117
filBE0D38B9447EBE515474DFD28225BD96
filD1073DF8FCCB127CCCB9FFEECA50D318
[Base64-Block@0x011FF81A]
[Base64-Block-Decoded]
[Authenticode]_74416516.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
WEVT_TEMPLATE
ID:0001
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:1033-preview.png
RT_MESSAGETABLE
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.idata
.didat
.00cfg
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
filECA8C1BA375155901533BEC85AA85BC3
filF823EE2AFCB2873CE8ACF265F6E9039E
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䖖㯬䏬㱨䖤䠫
䡀䘌䗶䐲䆊䌷䑲
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
DigitalSignature
SummaryInformation
MsiDigitalSignatureEx
fil07522DDC5130644E131F0583E826306E
filA3E01361C19F9119AA61D13BD2337117
filBE0D38B9447EBE515474DFD28225BD96
filD1073DF8FCCB127CCCB9FFEECA50D318
filDC3AFD07CC6B84650F829CF93F61B3CC
filE2B6F24377E399A5F690C3B3F219F983
filECA8C1BA375155901533BEC85AA85BC3
filF823EE2AFCB2873CE8ACF265F6E9039E
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 8 STICH kept: 2secondary ignored: 6
bin 5img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>scr:vbs~T1059.005
Shape ole:doc>scr:vbs
technique2 nodes
Path ole:doc>bin>pe:exe>enc:b64
Shape ole:doc>bin>pe:exe>enc:b64
4 nodes
Root Entry
䡀䌏䈯
䡀䈖䌧䠤
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䕙䓲䕨䜷
filA3E01361C19F9119AA61D13BD2337117
filBE0D38B9447EBE515474DFD28225BD96
filD1073DF8FCCB127CCCB9FFEECA50D318
[Base64-Block@0x011FF81A]
[Base64-Block-Decoded]
[Authenticode]_74416516.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
WEVT_TEMPLATE
ID:0001
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:1033-preview.png
RT_MESSAGETABLE
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.idata
.didat
.00cfg
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
filECA8C1BA375155901533BEC85AA85BC3
filF823EE2AFCB2873CE8ACF265F6E9039E
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䖖㯬䏬㱨䖤䠫
䡀䘌䗶䐲䆊䌷䑲
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
DigitalSignature
SummaryInformation
MsiDigitalSignatureEx
fil07522DDC5130644E131F0583E826306E
filA3E01361C19F9119AA61D13BD2337117
filBE0D38B9447EBE515474DFD28225BD96
filD1073DF8FCCB127CCCB9FFEECA50D318
filDC3AFD07CC6B84650F829CF93F61B3CC
filE2B6F24377E399A5F690C3B3F219F983
filECA8C1BA375155901533BEC85AA85BC3
filF823EE2AFCB2873CE8ACF265F6E9039E
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙