Malicious
Rar Archive
MD5: cfec81df0304572e72e383c38722f50f
Size: 1.92 MB
application/vnd.rar
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Rar archive
Size
1.92 MB · 1,923,153 B
First seen
2026-07-24 12:45 · 3 months ago
Last seen
2026-07-24 12:45 · 3 months ago
Last analysis
2026-07-25 08:11 · 3 months ago
Hashes
MD5
cfec81df0304572e72e383c38722f50f
Sha1
15cca745052649973bc2e7fe989d4216dc430dd5
Sha256
37471064f64d444ae89f427a4609ffe9df59908316708f10e0de291fb4809dcd
Sha384
2eb47bf3b8a4236e6743ca5099e19e5e9da72a28147d7c2d8f690fa269b04f1f438f41026dc96ceeb780590d09b974b9
Sha512
61d1ac16a1bfe2c3ac322688a0f94c8b980721d8a681b30adb3807a35aed8405bada22a07cd07fd408b5963fa8e745f5e706750165f5aa63aaaa8c8e3121cceb
SSDeep
49152:H5EtuezFil3R5FHhXG8kqKrpu6MyjZAjCtCmj:Z+ue4l3jVh/kqKr46Myj8CImj
TLSH
5E9533CA434166F1A26557DDB5A881CBFFE194A5B21BF0BF309C670461383E3C39A19B
27 malicious · 28 files
RARcfec81df0304572e72e383c38722f50fT1027 · T1059.001
PS1Inquiry for Quotation.jsT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:rar>scr:ps1~T1027~T1059.001
Shape
arc:rar>scr:ps1
malicious
2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
"+"
"huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"+"
"huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
" " +huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"
"huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential