Deep Malware Analysis of cbcb58ffe45c202c11bcf2070496aed6 | md5: cbcb58ffe45c202c11bcf2070496aed6 | Zip Archive | Executable | PE (Portable Executable) | Obfuscated | PE File Layout | SOS: 0.47 | PowerShell | Batch Command | PowerShell Call | WScript.Shell | MSXML2.XMLHTTP | ADODB.Stream | Scripting.FileSystemObject | DeObfuscated | VBScript | T1059.005 | T1027 | T1105 | T1059 | COM Behavior Trace | T1059.001

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	cbcb58ffe45c202c11bcf2070496aed6
Sha1	b47d1618177b6bc219b8734cd02f9cf7be7aff43
Sha256	7126b9932dc0cdfe751340edfa7c4a14b69262eb1afd0530e6d1fdb2e25986dd
Sha384	7452ae03fadbcdc4293a2bc20448a02537d71701595f2dc9e8095eed2018996b8eaab401bfc24d1182dcdb3f85bc2102
Sha512	97115e8faf2a0554d899f05931d29a99a500ff849d0f3fbf5ab5d36387b8938288e25804b8ef0b031a18ae04fd23e52959737f7b94a369e2fa55922861ef506d
SSDeep	98304:SyrPvG3UNpYqQLpXhHHeanDebmPL+okjWa1lu/:SyrPO3UDsdXp+z8+FWyE
TLSH	9DF53329C35BA51C444ED111B88E299A937D8D177E1E17314E43336CFE378AE3E8E2A5

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 5 STICH kept: 2secondary ignored: 3

bin 2img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>scr:vbe>scr:vbs~T1027~T1059~T1059.005~T1105>scr:bat>scr:ps1~T1059.001

Shape arc:zip>scr:vbe>scr:vbs>scr:bat>scr:ps1

malicious 5 nodes

Path arc:zip>scr:vbe>scr:vbs~T1027~T1059~T1059.005~T1105>scr:bat>scr:ps1~T1027~T1059.001

Shape arc:zip>scr:vbe>scr:vbs>scr:bat>scr:ps1

malicious 5 nodes

Config. Field	Value
URL (COM trace) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

cmd /chuhuhuhuhuhuhuhuhuhuhu

Command (COM trace) #2 UNKNWOWNmalicious

cmd /chuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #1 PATHmalicious

C:\Usehuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

(Writehuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential