Malicious
bdecede121b48d0b6384f3b293a04840
PE Executable
MD5: bdecede121b48d0b6384f3b293a04840
Size: 1.01 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
1.01 MB · 1,011,712 B
First seen
2026-08-17 20:16 · 2 months ago
Last seen
2026-08-17 20:16 · 2 months ago
Last analysis
2026-08-17 20:16 · 2 months ago
Hashes
MD5
bdecede121b48d0b6384f3b293a04840
Sha1
c96d8f8239bfb226798160c8c8e54353d3861ee9
Sha256
98268f4b9de6c8c17f83de8504302676c91710c6f801a73c94e2c43ef58b6100
Sha384
4a05de67f0c9cf67fbbebda08018a6eff1b58dd5d1206c984df39e2f57d2bd4b17637b7d18c6fd0044a301b812aaf004
Sha512
4e34bd866079ad01a0384b788f43384bfc1f9d4b0e8bb01430242053c67e16274c4ecbb014d4dc853009d03d7d3376a14a76e56a7758ab3ca8c33a438f50c4c9
SSDeep
24576:/QlZR+W3zeSuR6ZdhzTdKPHoWORFw3OSnnb:YXR+UM6V0oWOI/
TLSH
252501512BE61CB9F8EEE6347AB142635833FCB057F491DF168C81681A329D419F0B2E
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)
4 malicious · 45 files
EXEbdecede121b48d0b6384f3b293a04840T1027 · T1059.001
Structure
BINResources
BINAVI
BINID:0BB9
BINID:1033
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINRT_MENU
BINID:03E8
BINID:1033
BINRT_DIALOG
BINID:07D1
BINID:1033
BINID:2057
BINID:07D2
BINID:1033
BINID:07D3
BINID:1033
BINID:07D4
BINID:1033
BINID:2057
BINID:07D5
BINID:1033
BINID:2057
BINID:07D6
BINID:1033
BINRT_STRING
BINID:003F
BINID:1033
BINID:004C
BINID:1033
BINID:2057
BINID:004D
BINID:1033
BINID:2057
BINID:0050
BINID:1033
BINID:0053
BINID:1033
BINID:2057
BINID:0055
BINID:1033
BINID:2057
BINRT_RCDATA
BINID:0000
PS1ID:1033T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BINID:2057
DLLWindows.UI.BioFeedback.dll
BINRT_GROUP_CURSOR4
BINID:0BB8
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
EXEShellAppRuntime.exe
Structure
P7B[Authenticode]_1d00d588.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
DLLWindows.UI.BioFeedback.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 7
STICH kept: 2secondary ignored: 5
bin
4img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>scr:ps1~T1027~T1059.001
Shape
pe:exe>pe:rsrc>scr:ps1
malicious
3 nodes
Path
pe:exe>pe:rsrc>bin>pe:dll
Shape
pe:exe>pe:rsrc>bin>pe:dll
4 nodes
| Name | Value |
|---|---|
| Info | PDB Path: wextract.pdb |
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 45 files
EXEbdecede121b48d0b6384f3b293a04840T1027 · T1059.001
Structure
BINResources
BINAVI
BINRT_ICON
BINRT_MENU
BINRT_DIALOG
BINRT_STRING
BINRT_RCDATA
BINID:0000
PS1ID:1033T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BINID:2057
BINRT_GROUP_CURSOR4
BINRT_VERSION
BINRT_MANIFEST
EXEShellAppRuntime.exe
DLLWindows.UI.BioFeedback.dll
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
bdecede121b48d0b6384f3b293a04840 › Resources › RT_RCDATA › ID:0000 › ID:1033 › [PowerShell Command]
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
bdecede121b48d0b6384f3b293a04840 › Resources › RT_RCDATA › ID:0000 › ID:2057 › Windows.UI.BioFeedback.dll
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account