Malicious
c7b32f41601ff0cc571fd0d6008ac642
PE Executable
MD5: c7b32f41601ff0cc571fd0d6008ac642
Size: 229.38 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
229.38 KB · 229,376 B
First seen
2026-09-07 21:17 · one month ago
Last seen
2026-09-07 21:17 · one month ago
Last analysis
2026-09-07 21:17 · one month ago
Hashes
MD5
c7b32f41601ff0cc571fd0d6008ac642
Sha1
b5c7c4b3cc3dd7c9899d76e816921c9896175355
Sha256
549eaa713063504459dafab521d4f536e34ae6c090f7bb52acb7e74364256aaa
Sha384
c06bab64caad390d648c6cf1ef460c68366ff6aa532a450eb18a0f9a240755c652a8451ec8535dfe55778213a710f6d6
Sha512
df0ca4fbc2d25a047afa38d997af58c7a62ee6c51012b26b77e1c7b1a375988174bef6c90e11c3ba57eed5b7ed5a299898fc3a6d6a4cf984903fd642121e6927
SSDeep
3072:KRLiJRaxQRsgLY165GWp1icKAArDZz4N9GhbkrNEkO9qlTDdm3ppHqTJ:H3axQprp0yN90QEryipy
TLSH
F7248D0967E610A6F0B2677099F202834A39BC637B7592FF5780857D0E73AC4A971F63
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)
4 malicious · 54 files
EXEc7b32f41601ff0cc571fd0d6008ac642T1027 · T1059.001
Structure
EXEmsg711.acm
Structure
P7B[Authenticode]_b0d32a75.p7b
BINResources
BINMUI
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
EXEmsgsm32.acm
Structure
P7B[Authenticode]_dcb3d8e0.p7b
BINResources
BINMUI
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINResources
BINAVI
BINID:0BB9
BINID:1033
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
IMGID:1033
IMGID:1033-preview.png
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINRT_DIALOG
BINID:07D1
BINID:1033
BINID:2057
BINID:07D2
BINID:1033
BINID:07D3
BINID:1033
BINID:07D4
BINID:1033
BINID:2057
BINID:07D5
BINID:1033
BINID:2057
BINID:07D6
BINID:1033
BINRT_STRING
BINID:003F
BINID:1033
BINID:004C
BINID:1033
BINID:2057
BINID:004D
BINID:1033
BINID:2057
BINID:0050
BINID:1033
BINID:0053
BINID:1033
BINID:2057
BINID:0055
BINID:1033
BINID:2057
BINRT_RCDATA
BINID:0000
PS1ID:1033T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BINID:2057
EXEmsgsm32.acm
P7B[Authenticode]_c4fad8cf.p7b
EXE[Rebuild from dump]_faa836a4.exe
BINRT_GROUP_CURSOR4
BINID:0BB8
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINID:2057
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 7
STICH kept: 2secondary ignored: 5
bin
4img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>scr:ps1~T1027~T1059.001
Shape
pe:exe>pe:rsrc>scr:ps1
malicious
3 nodes
Path
pe:exe>pe:rsrc>bin>pe:dll>pe:dll
Shape
pe:exe>pe:rsrc>bin>pe:dll>pe:dll
5 nodes
| Name | Value |
|---|---|
| Info | PDB Path: wextract.pdb |
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 54 files
EXEc7b32f41601ff0cc571fd0d6008ac642T1027 · T1059.001
Structure
EXEmsg711.acm
EXEmsgsm32.acm
BINResources
BINAVI
BINRT_ICON
BINRT_DIALOG
BINRT_STRING
BINRT_RCDATA
BINID:0000
PS1ID:1033T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BINID:2057
BINRT_GROUP_CURSOR4
BINRT_VERSION
BINRT_MANIFEST
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
c7b32f41601ff0cc571fd0d6008ac642 › Resources › RT_RCDATA › ID:0000 › ID:1033 › [PowerShell Command]
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
c7b32f41601ff0cc571fd0d6008ac642 › Resources › RT_RCDATA › ID:0000 › ID:2057 › msgsm32.acm
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account