Malicious
d24014049064389357dab970e72e6298
PE Executable
MD5: d24014049064389357dab970e72e6298
Size: 4.64 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
4.64 MB · 4,641,032 B
First seen
2026-09-05 16:00 · one month ago
Last seen
2026-09-05 16:00 · one month ago
Last analysis
2026-09-05 16:00 · one month ago
Hashes
MD5
d24014049064389357dab970e72e6298
Sha1
210a5380007df4fa49140410938a39f2251d6548
Sha256
f535cdbb32dd25fa7dfbcdbae96eafbd5740882e46355c78c895224de6f22e4e
Sha384
4e2703b74b35e8c82f9c399278a8db911f00855616e07306f4003bcc901b11ee97d4005b2988b68d13f3a1f3c94d83e6
Sha512
53ebeeb2faafa2a8c7331cc9d10f1a2772f3ca6e18f77b64725e6099598b4614841c233fab2886407cc6bdc254e40e614df7b5a3970cc0dd24eb26a39b53d1f1
SSDeep
98304:+AYSNdx/hBiTCL3S+IkhRTWEqfn0FJEehp+8:+AYSNdx/Gp+IGZW9f0FJEehp+8
TLSH
C026BF56D1A943D8E473157895109AF05BE66CAEF1E4B402BDBCB42F4FB79C0C92A0B3
Detection
PeID
MSVC++ v.8 (procedure 1 recognized - h)Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8.0Microsoft Visual C++ 8.0Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
3 malicious · 169 files
EXEd24014049064389357dab970e72e6298T1027 · T1059.005 · T1059.007
Structure
7Z7z-stream @ 0x002CAAE9.7zT1059.007
EXEOverlay_ac49aa41.binT1059.007
Structure
P7B[Authenticode]_e6fb1fed.p7b
BINResources
BINPNG
BINID:0003
IMGID:2052
IMGID:2052-preview.png
BINID:0004
IMGID:2052
IMGID:2052-preview.png
BINID:0008
IMGID:2052
IMGID:2052-preview.png
BINID:0009
IMGID:2052
IMGID:2052-preview.png
BINID:000A
IMGID:2052
IMGID:2052-preview.png
BINID:000B
IMGID:2052
IMGID:2052-preview.png
BINID:000C
IMGID:2052
IMGID:2052-preview.png
BINID:000D
IMGID:2052
IMGID:2052-preview.png
BINID:000E
IMGID:2052
IMGID:2052-preview.png
BINID:000F
IMGID:2052
IMGID:2052-preview.png
BINID:0010
IMGID:2052
IMGID:2052-preview.png
BINID:0011
IMGID:2052
IMGID:2052-preview.png
BINID:0012
IMGID:2052
IMGID:2052-preview.png
BINID:0013
IMGID:2052
IMGID:2052-preview.png
BINID:0014
IMGID:2052
IMGID:2052-preview.png
BINID:0015
IMGID:2052
IMGID:2052-preview.png
BINID:0016
IMGID:2052
IMGID:2052-preview.png
BINID:0017
IMGID:2052
IMGID:2052-preview.png
BINID:0018
IMGID:2052
IMGID:2052-preview.png
BINID:0019
IMGID:2052
IMGID:2052-preview.png
BINID:001A
IMGID:2052
IMGID:2052-preview.png
BINID:001B
IMGID:2052
IMGID:2052-preview.png
BINID:001C
IMGID:2052
IMGID:2052-preview.png
BINID:001D
IMGID:2052
IMGID:2052-preview.png
BINID:001F
IMGID:2052
IMGID:2052-preview.png
BINID:0020
IMGID:2052
IMGID:2052-preview.png
BINID:0021
IMGID:2052
IMGID:2052-preview.png
BINID:0022
IMGID:2052
IMGID:2052-preview.png
BINID:0023
IMGID:2052
IMGID:2052-preview.png
BINID:0024
IMGID:2052
IMGID:2052-preview.png
BINID:0026
IMGID:2052
IMGID:2052-preview.png
BINID:0027
IMGID:2052
IMGID:2052-preview.png
BINID:0028
IMGID:2052
IMGID:2052-preview.png
BINID:0029
IMGID:2052
IMGID:2052-preview.png
BINID:002A
IMGID:2052
IMGID:2052-preview.png
BINID:002B
IMGID:2052
IMGID:2052-preview.png
BINID:0032
IMGID:2052
IMGID:2052-preview.png
BINID:0036
IMGID:2052
IMGID:2052-preview.png
BINID:0037
IMGID:2052
IMGID:2052-preview.png
BINID:0038
IMGID:2052
IMGID:2052-preview.png
BINID:0039
IMGID:2052
IMGID:2052-preview.png
BINID:003A
IMGID:2052
IMGID:2052-preview.png
BINID:003B
IMGID:2052
IMGID:2052-preview.png
BINID:003C
IMGID:2052
IMGID:2052-preview.png
BINID:003D
IMGID:2052
IMGID:2052-preview.png
BINID:003E
IMGID:2052
IMGID:2052-preview.png
BINID:003F
IMGID:2052
IMGID:2052-preview.png
BINID:0040
IMGID:2052
IMGID:2052-preview.png
BINID:0041
IMGID:2052
IMGID:2052-preview.png
BINID:0042
IMGID:2052
IMGID:2052-preview.png
BINID:0043
IMGID:2052
IMGID:2052-preview.png
BINID:0044
IMGID:2052
IMGID:2052-preview.png
BINID:0045
IMGID:2052
IMGID:2052-preview.png
BINID:0046
IMGID:2052
IMGID:2052-preview.png
BINID:0047
IMGID:2052
IMGID:2052-preview.png
BINID:0048
IMGID:2052
IMGID:2052-preview.png
BINID:0049
IMGID:2052
IMGID:2052-preview.png
BINID:004A
IMGID:2052
IMGID:2052-preview.png
BINID:004B
IMGID:2052
IMGID:2052-preview.png
BINID:004C
IMGID:2052
IMGID:2052-preview.png
BINID:004D
IMGID:2052
IMGID:2052-preview.png
BINID:004E
IMGID:2052
IMGID:2052-preview.png
BINID:004F
IMGID:2052
IMGID:2052-preview.png
BINID:0050
IMGID:2052
IMGID:2052-preview.png
BINID:0051
IMGID:2052
IMGID:2052-preview.png
BINID:0052
IMGID:2052
EXIFID:2052.exif
IMGID:2052-preview.png
BINID:0053
IMGID:2052
IMGID:2052-preview.png
BINID:0054
IMGID:2052
IMGID:2052-preview.png
BINID:0055
IMGID:2052
IMGID:2052-preview.png
BINID:0056
IMGID:2052
IMGID:2052-preview.png
BINXML
BINID:2710
VBSID:2052T1027 · T1059.005
VBSID:2052.deobfuscated.vbsT1059.005
BINID:2711
BINID:2052
BINID:2712
BINID:2052
BINID:2AF9
BINID:2052
BINID:2AFA
BINID:2052
BINID:2AFB
BINID:2052
BINID:2AFC
VBSID:2052T1027 · T1059.005
VBSID:2052.deobfuscated.vbsT1059.005
BINID:2AFD
BINID:2052
BINID:2AFE
BINID:2052
BINID:2AFF
BINID:2052
BINID:2B00
BINID:2052
BINRT_ICON
BINID:0001
BINID:2052
BINID:0002
BINID:2052
BINID:0003
BINID:2052
BINID:0004
BINID:2052
BINID:0005
BINID:2052
BINID:0006
BINID:2052
BINRT_GROUP_CURSOR4
BINID:0066
BINID:2052
BINID:00C8
BINID:2052
BINRT_VERSION
BINID:0001
BINID:0
BINID:2052
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
6 / 6
Path
pe:exe~T1059.007>pe:rsrc>img>img
Shape
pe:exe>pe:rsrc>img>img
technique4 nodes
Path
pe:exe~T1059.007>pe:exe~T1059.007>bin
Shape
pe:exe>pe:exe>bin
technique3 nodes
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_ac49aa41.bin (2797320 bytes) |
3 malicious · 169 files
EXEd24014049064389357dab970e72e6298T1027 · T1059.005 · T1059.007
Structure
7Z7z-stream @ 0x002CAAE9.7zT1059.007
EXEOverlay_ac49aa41.binT1059.007
BINResources
BINPNG
BINXML
BINID:2710
VBSID:2052T1027 · T1059.005
VBSID:2052.deobfuscated.vbsT1059.005
BINID:2711
BINID:2712
BINID:2AF9
BINID:2AFA
BINID:2AFB
BINID:2AFC
VBSID:2052T1027 · T1059.005
VBSID:2052.deobfuscated.vbsT1059.005
BINID:2AFD
BINID:2AFE
BINID:2AFF
BINID:2B00
BINRT_ICON
BINRT_GROUP_CURSOR4
BINRT_VERSION
BINRT_MANIFEST
No malware configuration was found at this point.
You must be signed in to view YARA rules.