Suspicious
Suspect

bfbbf30418735fa202dd952435235c23

Share on LinkedIn
Print
ZIP Archive
MD5: bfbbf30418735fa202dd952435235c23
Size: 16.87 MB
application/zip

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 bfbbf30418735fa202dd952435235c23
Sha1 df2b580f61876f7b2b7f1fea312eafb81ae3b406
Sha256 c5a3d94cb6b4be539b68401e2fbd8008740d230109ee13a5b3b863f8e2d935c1
Sha384 c970260c4ac6097e4045dad4002c9df41a0ad277bb5982943390a5dedef1724c8ffe5d561685b9e9b8f0b7960d97ea2d
Sha512 0504af2739a11ce5a97a0b53f5722e09a83eb1054d13b05930a5715d878f6ac856aa5ecaa7102f52322099cdfffb467010f29959416c635c395df91cb22183c8
SSDeep 393216:uIPdqdV/tYiXENQ14sXt10ANqkRZd6BVp81mJw1fsFi13:XqbSiSQ1JXLN/r6fDJ+kc13
TLSH 3B07339FD4110484BA3CEC6920C6C7D5CC136F1485BB6934AD0B9839676BBE6FE943AC
bfbbf30418735fa202dd952435235c23
AccessibleMarshal.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
freebl3.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
gkcodecs.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
lgpllibs.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
libEGL.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
libGLESv2.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
mozavcodec.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
mozavutil.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
mozglue.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
mozglue.manifest
mozinference.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
mozwer.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
msvcp140.dll
[Authenticode]_c434e7f7.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
notificationserver.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
nss3.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
nssutil3.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
plugin-container.exe
[Authenticode]_b61b84af.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.tls
.rsrc
.reloc
Resources
LIMITEDACCESSFEATURE
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
plugin-container.exe.local
softokn3.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140.dll
[Authenticode]_add9f1e3.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
fothk
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140_1.dll
[Authenticode]_2441bb51.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
wmfclearkey.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
.rsrc
.debug
.lcfg
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
xul.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 1secondary ignored: 5
bin 5

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:dll
Shape arc:zip>pe:dll
2 nodes
An error has occurred. This application may no longer respond until reloaded. Reload 🗙