Deep Malware Analysis of c0f13ff7406f012634843d16bf9138c6 | md5: c0f13ff7406f012634843d16bf9138c6 | Zip Archive | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | Executable | PE (Portable Executable) | PE File Layout | PDB Path

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c0f13ff7406f012634843d16bf9138c6
Sha1	a73fd4f43155ae3359a74213f7794cf9bff1e347
Sha256	9979fd4035e441512ead4e438b1c1a01c2713fb649ddf747dc469250255da04a
Sha384	baa118a37e345e2d9609c934114815fab40fc48b2741e044fb6784dfccad209db0bea237e2461a0d7e0d41231a95b8c5
Sha512	1533076aa4e4416dd585f03d09ecf3487b25bb829d15af6752b2af59c31cdef3bb290a79d36ccec69057138365d32150c5d231e68cf1fb143621dca08144f292
SSDeep	12288:Ar066Uv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZw:Ar066Uv4t1cNk/wjibhv4b2OnS
TLSH	32A4238274716D06D096CFBDE4C1AACAD06A023D35263BE5639294CABD940367F9BF13

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>scr:vbs~T1027~T1059.005

Shape arc:zip>scr:vbs

technique2 nodes

Path arc:zip>pe:exe

Shape arc:zip>pe:exe

2 nodes