Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
ZIP archive
Size
26.97 MB · 26,967,831 B
First seen
2026-09-04 10:45 · one month ago
Last seen
2026-09-04 10:45 · one month ago
Last analysis
2026-09-04 10:49 · one month ago
Hashes
MD5 d280afbaeaf79e2d04dcd11950acb0f2 Sha1 405823dc041dc92ee28da721f21e387d3a6067a0 Sha256 cb263dbd6d073ea665adb55388be1bf00d335af12a8c12c49a38281b22d0d0f5 Sha384 8a3729ffad07d570056f9aaa6b1b7f67f094a3454499387eab998b08b4f35f15e1e9f508a300ac601587cfa3da1dcf62 Sha512 fc6bd40bd8fa6f1cb7dd0f1fd02e2e2e63c7b452cf9aef1a71cd5cfee1b7487cbd21aaed43370701397ab98e0483d100ce56f1ed57e4dc643cf939af62c92a26 SSDeep 786432:S1FXWiL4AWiLMnlXWHZZxkejCu01EqWiLaTzqqrOh:S1cn1nleZIc01+brY TLSH 9E47330715E64FD4E95E8939D0E72303315CAE6A8106A39ED77DC32B3FF36A48E18199
3 malicious · 840 files
ZIPd280afbaeaf79e2d04dcd11950acb0f2CVE-2019-9674
BINlic
BINbin
EXEdiskpl.exe
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0065
BINID:1033
BINdiskpl.exe.manifest
FLXdiskpl.flx
ICOdiskpl.ico
DLLlibmng.dll
Structure
DLLlibmon.dll
Structure
DLLlibpal.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibspg.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
HTMlibspp.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLQtCore4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
JSQtGui4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEsppinst.exe
Structure
EXEsppshex.exe
Structure
DLLqgif4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqjpeg4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqmng4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqsvg4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLqtiff4.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLmfc110.dll
Structure
P7B[Authenticode]_43c43228.p7b
BINResources
BINPNG
BINID:0000
IMGID:1033
IMGID:1033-preview.png
BINSTYLE_XML
BINID:0000
BINID:1033
BINRT_CURSOR
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINID:0011
BINID:1033
BINID:0012
BINID:1033
BINID:0013
BINID:1033
BINID:0015
BINID:1033
BINID:0016
BINID:1033
BINID:0017
BINID:1033
BINID:0018
BINID:1033
BINID:0019
BINID:1033
BINID:001A
BINID:1033
BINID:001B
BINID:1033
BINID:001C
BINID:1033
BINID:001D
BINID:1033
BINID:001E
BINID:1033
BINID:001F
BINID:1033
BINID:0020
BINID:1033
BINID:0021
BINID:1033
BINID:0022
BINID:1033
BINID:0023
BINID:1033
BINID:0024
BINID:1033
BINID:0025
BINID:1033
BINID:0026
BINID:1033
BINID:0027
BINID:1033
BINID:0028
BINID:1033
BINID:0029
BINID:1033
BINID:002A
BINID:1033
BINID:002B
BINID:1033
BINID:002C
BINID:1033
BINID:002D
BINID:1033
BINID:002E
BINID:1033
BINID:002F
BINID:1033
BINID:0030
BINID:1033
BINID:0031
BINID:1033
BINID:0032
BINID:1033
BINRT_BITMAP
BINID:3F01
BINID:1033
BINID:3F03
BINID:1033
BINID:3F0A
BINID:1033
BINID:3F0B
BINID:1033
BINID:4221
BINID:1033
BINID:4222
BINID:1033
BINID:4223
BINID:1033
BINID:4224
BINID:1033
BINID:423D
BINID:1033
BINID:4240
BINID:1033
BINID:4261
BINID:1033
BINID:4262
BINID:1033
BINID:4268
BINID:1033
BINID:427B
BINID:1033
BINID:4288
BINID:1033
BINID:4289
BINID:1033
BINID:428A
BINID:1033
BINID:428B
BINID:1033
BINID:428C
BINID:1033
BINID:428D
BINID:1033
BINID:4296
BINID:1033
BINID:4299
BINID:1033
BINID:429A
BINID:1033
BINID:429B
BINID:1033
BINID:429C
BINID:1033
BINID:429D
BINID:1033
BINID:429E
BINID:1033
BINID:429F
BINID:1033
BINID:42A1
BINID:1033
BINID:42AB
BINID:1033
BINID:42B8
BINID:1033
BINID:42C1
BINID:1033
BINID:42C2
BINID:1033
BINID:42DD
BINID:1033
BINID:42DE
BINID:1033
BINID:42DF
BINID:1033
BINID:42E0
BINID:1033
BINID:42E1
BINID:1033
BINID:42E2
BINID:1033
BINID:42E3
BINID:1033
BINID:42E4
BINID:1033
BINID:42E5
BINID:1033
BINID:42E6
BINID:1033
BINID:42E7
BINID:1033
BINID:7912
BINID:1033
BINID:7914
BINID:1033
BINRT_ICON
BINID:0033
BINID:1033
BINID:0034
BINID:1033
BINID:0035
BINID:1033
BINID:0036
BINID:1033
BINID:0037
BINID:1033
BINID:0038
BINID:1033
BINID:0039
BINID:1033
BINID:003A
BINID:1033
BINID:003B
BINID:1033
BINID:003C
BINID:1033
BINID:003D
BINID:1033
BINID:003E
BINID:1033
BINRT_MENU
BINID:3EE6
BINID:1033
BINRT_DIALOG
BINID:3EE8
BINID:1033
BINID:3EE9
BINID:1033
BINID:3F02
BINID:1033
BINID:3F04
BINID:1033
BINID:3F05
BINID:1033
BINID:3F06
BINID:1033
BINID:3F07
BINID:1033
BINID:3F08
BINID:1033
BINID:3F09
BINID:1033
BINID:4112
BINID:1033
BINID:421F
BINID:1033
BINID:4220
BINID:1033
BINID:4241
BINID:1033
BINID:4242
BINID:1033
BINID:4243
BINID:1033
BINID:4256
BINID:1033
BINID:426C
BINID:1033
BINID:42A2
BINID:1033
BINID:42B2
BINID:1033
BINID:42B4
BINID:1033
BINID:7801
BINID:1033
BINID:7802
BINID:1033
BINID:7803
BINID:1033
BINID:780E
BINID:1033
BINID:7E01
BINID:1033
BINID:7E02
BINID:1033
BINID:7E03
BINID:1033
BINRT_STRING
BINID:03E9
BINID:1033
BINID:03EA
BINID:1033
BINID:03EB
BINID:1033
BINID:03EF
BINID:1033
BINID:03F0
BINID:1033
BINID:03F8
BINID:1033
BINID:03FB
BINID:1033
BINID:0421
BINID:1033
BINID:0428
BINID:1033
BINID:0429
BINID:1033
BINID:042A
BINID:1033
BINID:042C
BINID:1033
BINID:042D
BINID:1033
BINID:042E
BINID:1033
BINID:042F
BINID:1033
BINID:0E01
BINID:1033
BINID:0E11
BINID:1033
BINID:0E12
BINID:1033
BINID:0E13
BINID:1033
BINID:0E14
BINID:1033
BINID:0E15
BINID:1033
BINID:0E16
BINID:1033
BINID:0E17
BINID:1033
BINID:0E21
BINID:1033
BINID:0E22
BINID:1033
BINID:0E31
BINID:1033
BINID:0E71
BINID:1033
BINID:0E81
BINID:1033
BINID:0E91
BINID:1033
BINID:0EF1
BINID:1033
BINID:0EF2
BINID:1033
BINID:0EFE
BINID:1033
BINID:0F01
BINID:1033
BINID:0F02
BINID:1033
BINID:0F03
BINID:1033
BINID:0F05
BINID:1033
BINID:0F09
BINID:1033
BINID:0F0A
BINID:1033
BINID:0F11
BINID:1033
BINID:0F12
BINID:1033
BINID:0F13
BINID:1033
BINID:0F14
BINID:1033
BINID:0F19
BINID:1033
BINID:0F1A
BINID:1033
BINID:0F1B
BINID:1033
BINID:0F1C
BINID:1033
BINID:0F1D
BINID:1033
BINID:0F29
BINID:1033
BINID:0F2A
BINID:1033
BINID:0F2C
BINID:1033
BINID:0F2F
BINID:1033
BINID:0FE1
BINID:1033
BINID:0FE2
BINID:1033
BINID:0FE3
BINID:1033
BINID:0FE4
BINID:1033
BINID:0FE5
BINID:1033
BINID:0FE9
BINID:1033
BINID:0FEB
BINID:1033
BINID:0FEC
BINID:1033
BINID:0FED
BINID:1033
BINRT_ACCELERATOR
BINID:7915
BINID:1033
BINRT_GROUP_CURSOR2
BINID:3E84
BINID:1033
BINID:3F05
BINID:1033
BINID:3F0C
BINID:1033
BINID:3F0D
BINID:1033
BINID:3F0E
BINID:1033
BINID:3F0F
BINID:1033
BINID:3F10
BINID:1033
BINID:3F11
BINID:1033
BINID:3F12
BINID:1033
BINID:4217
BINID:1033
BINID:4297
BINID:1033
BINID:4298
BINID:1033
BINID:7901
BINID:1033
BINID:7902
BINID:1033
BINID:7903
BINID:1033
BINID:7904
BINID:1033
BINID:7905
BINID:1033
BINID:7906
BINID:1033
BINID:7907
BINID:1033
BINID:7908
BINID:1033
BINID:7909
BINID:1033
BINID:790A
BINID:1033
BINID:790B
BINID:1033
BINID:790C
BINID:1033
BINID:7916
BINID:1033
BINID:7917
BINID:1033
BINID:7918
BINID:1033
BINID:7919
BINID:1033
BINID:791A
BINID:1033
BINID:791B
BINID:1033
BINID:791C
BINID:1033
BINID:791D
BINID:1033
BINID:791E
BINID:1033
BINID:791F
BINID:1033
BINID:7920
BINID:1033
BINID:7921
BINID:1033
BINID:7922
BINID:1033
BINID:7923
BINID:1033
BINRT_GROUP_CURSOR4
BINID:4223
BINID:1033
BINID:4263
BINID:1033
BINID:42CC
BINID:1033
BINID:42D1
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_DLGINIT
BINID:7E02
BINID:1033
BINRT_TOOLBAR
BINID:3F0A
BINID:1033
BINID:4240
BINID:1033
DLLpython37.dll
Structure
BINOverlay_90cc08de.bin
BINResources
BINRT_CURSOR
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINRT_BITMAP
BINID:0000
BINID:1033
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINID:000E
BINID:1033
BINID:000F
BINID:1033
BINID:0010
BINID:1033
BINID:0011
BINID:1033
BINID:0012
BINID:1033
BINRT_RCDATA
BINID:0000
EXEID:0
Structure
P7B[Authenticode]_50a7f493.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEID:1033
Structure
P7B[Authenticode]_56677623.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_GROUP_CURSOR2
BINID:0000
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0065
BINID:1033
BINID:00C9
BINID:1033
BINID:00CA
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
EXESetup.exe
Structure
P7B[Authenticode]_8a74c34a.p7b
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
DLLvcruntime140.dll
Structure
P7B[Authenticode]_fcfc5664.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINdoc
PDFdiskpulse_manual.pdf
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
TXTPage #12
TXTPage #13
TXTPage #14
TXTPage #15
TXTPage #16
TXTPage #17
TXTPage #18
TXTPage #19
TXTPage #20
TXTPage #21
TXTPage #22
TXTPage #23
TXTPage #24
TXTPage #25
TXTPage #26
TXTPage #27
TXTPage #28
TXTPage #29
TXTPage #30
TXTPage #31
TXTPage #32
TXTPage #33
TXTPage #34
TXTPage #35
TXTPage #36
TXTPage #37
TXTPage #38
TXTPage #39
TXTPage #40
TXTPage #41
TXTPage #42
TXTPage #43
TXTPage #44
TXTPage #45
TXTPage #46
TXTPage #47
TXTPage #48
TXTPage #49
TXTPage #50
TXTPage #51
TXTPage #52
TXTPage #53
TXTPage #54
TXTPage #55
TXTPage #56
TXTPage #57
TXTPage #58
TXTPage #59
TXTPage #60
TXTPage #61
TXTPage #62
TXTPage #63
TXTPage #64
TXTPage #65
TXTPage #66
TXTPage #67
TXTPage #68
TXTPage #69
TXTPage #70
TXTPage #71
TXTPage #72
TXTPage #73
TXTPage #74
TXTPage #75
TXTPage #76
TXTPage #77
TXTPage #78
TXTPage #79
BIN#Stream obj 15 0
BIN#Stream obj 533 0
BIN#Stream obj 537 0
BIN#Stream obj 534 0
BIN#Stream obj 538 0
BIN#Stream obj 535 0
BIN#Stream obj 539 0
BIN#Stream obj 536 0
BIN#Stream obj 540 0
BIN#Stream obj 5 0
BIN#Stream obj 19 0
BIN#Stream obj 28 0
BIN#Stream obj 27 0
BIN#Stream obj 24 0
BIN#Stream obj 35 0
BIN#Stream obj 34 0
BIN#Stream obj 32 0
BIN#Stream obj 39 0
BIN#Stream obj 46 0
BIN#Stream obj 45 0
BIN#Stream obj 43 0
BIN#Stream obj 52 0
BIN#Stream obj 50 0
BIN#Stream obj 59 0
BIN#Stream obj 58 0
BIN#Stream obj 56 0
BIN#Stream obj 65 0
BIN#Stream obj 63 0
BIN#Stream obj 73 0
BIN#Stream obj 72 0
BIN#Stream obj 71 0
BIN#Stream obj 69 0
BIN#Stream obj 80 0
BIN#Stream obj 79 0
BIN#Stream obj 77 0
BIN#Stream obj 88 0
BIN#Stream obj 87 0
BIN#Stream obj 86 0
BIN#Stream obj 84 0
BIN#Stream obj 95 0
BIN#Stream obj 94 0
BIN#Stream obj 92 0
BIN#Stream obj 102 0
BIN#Stream obj 101 0
BIN#Stream obj 99 0
BIN#Stream obj 109 0
BIN#Stream obj 108 0
BIN#Stream obj 106 0
BIN#Stream obj 116 0
BIN#Stream obj 115 0
BIN#Stream obj 113 0
BIN#Stream obj 124 0
BIN#Stream obj 123 0
BIN#Stream obj 122 0
BIN#Stream obj 120 0
BIN#Stream obj 131 0
BIN#Stream obj 130 0
BIN#Stream obj 128 0
BIN#Stream obj 138 0
BIN#Stream obj 137 0
BIN#Stream obj 135 0
BIN#Stream obj 145 0
BIN#Stream obj 144 0
BIN#Stream obj 142 0
BIN#Stream obj 152 0
BIN#Stream obj 151 0
BIN#Stream obj 149 0
BIN#Stream obj 158 0
BIN#Stream obj 156 0
BIN#Stream obj 167 0
BIN#Stream obj 166 0
BIN#Stream obj 164 0
BIN#Stream obj 174 0
BIN#Stream obj 173 0
BIN#Stream obj 171 0
BIN#Stream obj 181 0
BIN#Stream obj 180 0
BIN#Stream obj 178 0
BIN#Stream obj 187 0
BIN#Stream obj 185 0
BIN#Stream obj 194 0
BIN#Stream obj 193 0
BIN#Stream obj 191 0
BIN#Stream obj 200 0
BIN#Stream obj 198 0
BIN#Stream obj 206 0
BIN#Stream obj 204 0
BIN#Stream obj 213 0
BIN#Stream obj 212 0
BIN#Stream obj 210 0
BIN#Stream obj 220 0
BIN#Stream obj 219 0
BIN#Stream obj 217 0
BIN#Stream obj 226 0
BIN#Stream obj 224 0
BIN#Stream obj 232 0
BIN#Stream obj 230 0
BIN#Stream obj 239 0
BIN#Stream obj 238 0
BIN#Stream obj 236 0
BIN#Stream obj 243 0
BIN#Stream obj 251 0
BIN#Stream obj 250 0
BIN#Stream obj 249 0
BIN#Stream obj 247 0
BIN#Stream obj 259 0
BIN#Stream obj 258 0
BIN#Stream obj 257 0
BIN#Stream obj 255 0
BIN#Stream obj 265 0
BIN#Stream obj 263 0
BIN#Stream obj 272 0
BIN#Stream obj 271 0
BIN#Stream obj 269 0
BIN#Stream obj 279 0
BIN#Stream obj 278 0
BIN#Stream obj 276 0
BIN#Stream obj 286 0
BIN#Stream obj 285 0
BIN#Stream obj 283 0
BIN#Stream obj 293 0
BIN#Stream obj 292 0
BIN#Stream obj 290 0
BIN#Stream obj 299 0
BIN#Stream obj 297 0
BIN#Stream obj 306 0
BIN#Stream obj 305 0
BIN#Stream obj 303 0
BIN#Stream obj 313 0
BIN#Stream obj 312 0
BIN#Stream obj 310 0
BIN#Stream obj 317 0
BIN#Stream obj 324 0
BIN#Stream obj 322 0
BIN#Stream obj 328 0
BIN#Stream obj 336 0
BIN#Stream obj 335 0
BIN#Stream obj 333 0
BIN#Stream obj 343 0
BIN#Stream obj 342 0
BIN#Stream obj 340 0
BIN#Stream obj 350 0
BIN#Stream obj 349 0
BIN#Stream obj 347 0
BIN#Stream obj 357 0
BIN#Stream obj 356 0
BIN#Stream obj 354 0
BIN#Stream obj 364 0
BIN#Stream obj 363 0
BIN#Stream obj 361 0
BIN#Stream obj 370 0
BIN#Stream obj 368 0
BIN#Stream obj 376 0
BIN#Stream obj 374 0
BIN#Stream obj 383 0
BIN#Stream obj 382 0
BIN#Stream obj 380 0
BIN#Stream obj 390 0
BIN#Stream obj 389 0
BIN#Stream obj 387 0
BIN#Stream obj 397 0
BIN#Stream obj 396 0
BIN#Stream obj 394 0
BIN#Stream obj 404 0
BIN#Stream obj 403 0
BIN#Stream obj 401 0
BIN#Stream obj 411 0
BIN#Stream obj 410 0
BIN#Stream obj 408 0
BIN#Stream obj 418 0
BIN#Stream obj 417 0
BIN#Stream obj 415 0
BIN#Stream obj 425 0
BIN#Stream obj 424 0
BIN#Stream obj 422 0
BIN#Stream obj 429 0
BIN#Stream obj 434 0
BIN#Stream obj 438 0
BIN#Stream obj 445 0
BIN#Stream obj 444 0
BIN#Stream obj 442 0
BIN#Stream obj 451 0
BIN#Stream obj 449 0
BIN#Stream obj 457 0
BIN#Stream obj 455 0
BIN#Stream obj 465 0
BIN#Stream obj 464 0
BIN#Stream obj 463 0
BIN#Stream obj 461 0
BIN#Stream obj 472 0
BIN#Stream obj 471 0
BIN#Stream obj 469 0
BIN#Stream obj 479 0
BIN#Stream obj 478 0
BIN#Stream obj 476 0
BIN#Stream obj 486 0
BIN#Stream obj 485 0
BIN#Stream obj 483 0
BIN#Stream obj 493 0
BIN#Stream obj 492 0
BIN#Stream obj 490 0
BIN#Stream obj 500 0
BIN#Stream obj 499 0
BIN#Stream obj 497 0
BIN#Stream obj 507 0
BIN#Stream obj 506 0
BIN#Stream obj 504 0
BIN#Stream obj 513 0
BIN#Stream obj 511 0
BIN#Stream obj 520 0
BIN#Stream obj 519 0
BIN#Stream obj 517 0
BIN#Stream obj 526 0
BIN#Stream obj 524 0
BIN#Stream obj 530 0
BIN#Stream obj 541 0
TXTStructure
BINinfo
DLLAdvanceBackup.dll
Structure
BIN.Net Resources
BINAdvanceBackup.AdvancedBackup.resources
BINAdvanceBackup.ExchangeRestoreSteps.resources
BINAdvanceBackup.Exchange.ExchangeServerControl.resources
BINpictExchRstHelp.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpictLocalBkpHelp.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAdvanceBackup.Exchange.ExchBrickControl.resources
BINAdvanceBackup.Office365.Office365Control.resources
BINAdvanceBackup.Oracle.OracleServerControl.resources
VBSAdvanceBackup.Properties.Resources.resources
BINib_ico_loginrefresh_click
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_ico_loginrefresh_hover
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_ico_loginrefresh_normal
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_miniarrow
BINib_miniarrow_desc
BINib_miniarrow_new
BINib_serverico_backup
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_backup_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_backup_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_restore
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_restore_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINib_serverico_restore_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_big_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_big_nor
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_big_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_medium_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_medium_nor
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_medium_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_small_clk
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_small_nor
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_btn_small_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_cbt_tooltip
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_connecting2
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_help12_1
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_msgbox_hedbg
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINide_pic_Close
BINids_btn_serverlogin_click
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINids_btn_serverlogin_hover
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINids_btn_serverlogin_normal
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpause_btn
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINplay_btn
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpopup_logo
IMG[NBF]root.Data
BINwhitedownarrow_nor
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINwhitedownarrow_ovr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAdvanceBackup.SharePoint.SharePointControl.resources
BINAdvanceBackup.SQLLogin.resources
BINimageList1.ImageStream
DATA[NBF]root.Data
BINAdvanceBackup.SQLServer.SQLServerControl.resources
BINpictpauseresume.Image
IMG[NBF]root.Data
BINAdvanceBackup.SystemState.SystemStateControl.resources
BINAdvanceBackup.VMWare.VMwareControl.resources
BINAdvanceBackup.VMware.VMwareLogin.resources
BINpictLoginClose.Image
BINAdvanceBackup.VMware.vmwRestoreSummary.resources
BINpictBoxLogo.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINResources
BINRT_VERSION
BINID:0001
BINID:0
VBSunins000.dat
VBSunins000.exe
Structure
P7B[Authenticode]_046e6fde.p7b
BINResources
BINRT_CURSOR
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINRT_BITMAP
BINID:0000
BINID:0
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
IMGID:1033
IMGID:1033-preview.png
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINRT_STRING
BINID:0FF0
BINID:0
BINID:0FF1
BINID:0
BINID:0FF2
BINID:0
BINID:0FF3
BINID:0
BINID:0FF4
BINID:0
BINID:0FF5
BINID:0
BINID:0FF6
BINID:0
BINID:0FF7
BINID:0
BINID:0FF8
BINID:0
BINID:0FF9
BINID:0
BINID:0FFA
BINID:0
BINID:0FFB
BINID:0
BINID:0FFC
BINID:0
BINID:0FFD
BINID:0
BINID:0FFE
BINID:0
BINID:0FFF
BINID:0
BINID:1000
BINID:0
BINRT_RCDATA
BINID:0000
EXEID:1033
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:1033
BINRT_STRING
BINID:0001
BINID:1027
BINID:1028
BINID:1029
BINID:1030
BINID:1031
BINID:1032
BINID:1033
BINID:1034
BINID:1035
BINID:1036
BINID:1038
BINID:1039
BINID:1040
BINID:1041
BINID:1042
BINID:1043
BINID:1044
BINID:1045
BINID:1046
BINID:1049
BINID:1051
BINID:1053
BINID:1055
BINID:1060
BINID:1069
BINID:2052
BINID:2070
BINRT_VERSION
BINID:0001
BINID:0
BINOverlay_8ad664d7.bin
BINID:0
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
MSGunins000.msg
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
19 / 19
Path arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious 6 nodes
Path arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious 6 nodes
Config. Field Value
URL #1 https:huhuhuhuhuhuhuhuhuhuhu
URL #2 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.4
Author
Flexense Ltd.
CreationDate
D:20260204125540+02'00'
Creator
PDFCreator Version 1.2.3
Keywords
DiskPulse, Disk Change Monitor
ModifiedDate
D:20260204125540+02'00'
Subject
DiskPulse Disk Change Monitor
Title
DiskPulse Disk Change Monitor
Producer
GPL Ghostscript 9.04
/Producer
GPL Ghostscript 9.04
/CreationDate
D:20260204125540+02'00'
/ModDate
D:20260204125540+02'00'
/Title
DiskPulse Disk Change Monitor
/Creator
PDFCreator Version 1.2.3
/Author
Flexense Ltd.
/Keywords
DiskPulse, Disk Change Monitor
/Subject
DiskPulse Disk Change Monitor
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3 malicious · 840 files
ZIPd280afbaeaf79e2d04dcd11950acb0f2CVE-2019-9674
DLLpython37.dll
Structure
BINOverlay_90cc08de.bin
BINinfo
VBSunins000.dat
MSGunins000.msg
Config. Field Value
URL #1 https:huhuhuhuhuhuhuhuhuhuhu
URL #2 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
d280afbaeaf79e2d04dcd11950acb0f2 › info › unins000.dat
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙