Suspicious
Suspect

d4bdb3a3f621a1830546419e1980a381

ZIP Archive
MD5: d4bdb3a3f621a1830546419e1980a381
Size: 3.87 MB
application/zip

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d4bdb3a3f621a1830546419e1980a381
Sha1 3b131c3a6064c1a457e7b8384ce8b541edf7209e
Sha256 b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b
Sha384 3c75d228da138ab5422b5dee21cc148a085e3fc3da96336ed841766df16124cb5e0d4a49c4d81ff5e1e2927d520333e6
Sha512 031b182e3f03f0c1d3b87f691902cb5fd29608c6cb03bcd2f92ba8ff4be7e148b74f0a40b4beafe9a7c05e671330854627d2177f532652528c3094b8c8d50f3f
SSDeep 98304:1mBzF2zK+m1nDjnukH2L7mDhiJlJpAgIqnmbO5w:kIK+GDjukH2el0AcnW
TLSH E506338A40763610E9E1F2BC91AE676FDAD758E13175F93F0969F4000E7A89A5B30337
d4bdb3a3f621a1830546419e1980a381
static
check_5610944.png
check_5610944.png-preview.png
COB-BOB-IRT-enroll_tractor.jpg
COB-BOB-IRT-enroll_tractor.jpg.exif
COB-BOB-IRT-enroll_tractor.jpg-preview.png
Interdiction.bb46a732e12eabdef3c0.chunk.css
js
jquery-3.7.1.min.js
ui_card.js
ui_emailotp.js
ui_logon - copia.js
ui_logon.js
ui_otpsms.js
ui_wireless.js
main.6539fceb73733687f14d.css
main.7e149a8530327875d4f8.css
[Base64-Block@0x0000355F]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x00003FC9]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x00005C46]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x00005E6C]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x0000624A]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x000082CA]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x00008DF1]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x000092F1]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x0003006A]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x0003105C]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
src_app_page_login_Login_js.7bcb9ada66a4959d7c4c.chunk.css
wellsfargosans-rg.woff
wellsfargosans-rg.woff2
wellsfargosans-sbd.woff
wellsfargosans-sbd.woff2
wellsfargoserif-rg.woff
wellsfargoserif-rg.woff2
wfui.6362463d530db2fe67a3.css
wfui.8371e772fb2cafb2a7d0.css
.htaccess
config.php
index.php
sing_on.php
0x00004128.svg
0x0000899C.svg
0x0000899C.svg-preview.jpg
0x0001354E.svg
0x0001354E.svg-preview.jpg
0x00019CFD.svg
0x00019CFD.svg-preview.jpg
0x0001C94E.svg
0x0001C94E.svg-preview.jpg
0x00023DB6.svg
0x00023DB6.svg-preview.jpg
0x0003638E.svg
0x0003638E.svg-preview.jpg
0x0003A722.svg
0x0003A722.svg-preview.jpg
0x00046113.svg
0x00046113.svg-preview.jpg
verified.php
wait.php
0x000271A2.svg
0x000271A2.svg-preview.jpg
wireless.php
0x000047EB.svg
0x000047EB.svg-preview.jpg
0x0003BD3E.svg
0x0003BD3E.svg-preview.jpg
admintus
backend.php
config
dist
css
1.jpg-preview.png
custom-select.png
custom-select.png-preview.png
fa-brands-400-1.eot
fa-brands-400.svg
fa-brands-400.svg
0x00000140.svg
fa-brands-400.ttf
fa-brands-400.woff
fa-brands-400.woff2
fa-regular-400-1.eot
fa-regular-400.svg
fa-regular-400.svg
0x00000140.svg
fa-regular-400.ttf
fa-regular-400.woff
fa-regular-400.woff2
fa-solid-900-1.eot
fa-solid-900.svg
fa-solid-900.svg
0x00000140.svg
fa-solid-900.ttf
fa-solid-900.woff
fa-solid-900.woff2
favicon.png
favicon.png-preview.png
fontawesome-all.css
index.html
logo-icon.png
logo-icon.png-preview.png
logo-text.png
logo-text.png-preview.png
materialdesignicons-webfont-1.eot
materialdesignicons-webfont.svg
materialdesignicons-webfont.ttf
materialdesignicons-webfont.woff
materialdesignicons-webfont.woff2
materialdesignicons.min.css
pe03MImSLYBIv1o4X1M8cc8aBc5iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8aBc5jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8aBc5tU1E.woff2
pe03MImSLYBIv1o4X1M8cc8GBs5iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8GBs5jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8GBs5tU1E.woff2
pe03MImSLYBIv1o4X1M8cc8WAc5iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8WAc5jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8WAc5tU1E.woff2
pe03MImSLYBIv1o4X1M8cc9iB85iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc9iB85jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc9iB85tU1E.woff2
pe0qMImSLYBIv1o4X1M8cce9I9s.woff2
pe0qMImSLYBIv1o4X1M8cceyI9tScg.woff2
pe0qMImSLYBIv1o4X1M8ccezI9tScg.woff2
style.css
style.min.css
themify-1.eot
themify-icons.css
themify.svg
themify.ttf
themify.woff
jquery.min.js
jquery.slim.min.js
installerdb.php
IPBam.txt
login.php
antibots
Bot-Crawler.php
Bot-neo.php
Dila_DZ.php
index.php
IP-BlackList.php
helpers
class
UserInfo.php
functions.php
loginx.php
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5
img 4bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>html>enc:b64
Shape arc:zip>html>enc:b64
3 nodes
Path arc:zip>html
Shape arc:zip>html
2 nodes
d4bdb3a3f621a1830546419e1980a381
static
check_5610944.png
check_5610944.png-preview.png
COB-BOB-IRT-enroll_tractor.jpg
COB-BOB-IRT-enroll_tractor.jpg.exif
COB-BOB-IRT-enroll_tractor.jpg-preview.png
Interdiction.bb46a732e12eabdef3c0.chunk.css
js
jquery-3.7.1.min.js
ui_card.js
ui_emailotp.js
ui_logon - copia.js
ui_logon.js
ui_otpsms.js
ui_wireless.js
main.6539fceb73733687f14d.css
main.7e149a8530327875d4f8.css
[Base64-Block@0x0000355F]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x00003FC9]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x00005C46]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x00005E6C]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x0000624A]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x000082CA]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x00008DF1]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x000092F1]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x0003006A]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x0003105C]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
src_app_page_login_Login_js.7bcb9ada66a4959d7c4c.chunk.css
wellsfargosans-rg.woff
wellsfargosans-rg.woff2
wellsfargosans-sbd.woff
wellsfargosans-sbd.woff2
wellsfargoserif-rg.woff
wellsfargoserif-rg.woff2
wfui.6362463d530db2fe67a3.css
wfui.8371e772fb2cafb2a7d0.css
.htaccess
config.php
index.php
sing_on.php
0x00004128.svg
0x0000899C.svg
0x0000899C.svg-preview.jpg
0x0001354E.svg
0x0001354E.svg-preview.jpg
0x00019CFD.svg
0x00019CFD.svg-preview.jpg
0x0001C94E.svg
0x0001C94E.svg-preview.jpg
0x00023DB6.svg
0x00023DB6.svg-preview.jpg
0x0003638E.svg
0x0003638E.svg-preview.jpg
0x0003A722.svg
0x0003A722.svg-preview.jpg
0x00046113.svg
0x00046113.svg-preview.jpg
verified.php
wait.php
0x000271A2.svg
0x000271A2.svg-preview.jpg
wireless.php
0x000047EB.svg
0x000047EB.svg-preview.jpg
0x0003BD3E.svg
0x0003BD3E.svg-preview.jpg
admintus
backend.php
config
dist
css
1.jpg-preview.png
custom-select.png
custom-select.png-preview.png
fa-brands-400-1.eot
fa-brands-400.svg
fa-brands-400.svg
0x00000140.svg
fa-brands-400.ttf
fa-brands-400.woff
fa-brands-400.woff2
fa-regular-400-1.eot
fa-regular-400.svg
fa-regular-400.svg
0x00000140.svg
fa-regular-400.ttf
fa-regular-400.woff
fa-regular-400.woff2
fa-solid-900-1.eot
fa-solid-900.svg
fa-solid-900.svg
0x00000140.svg
fa-solid-900.ttf
fa-solid-900.woff
fa-solid-900.woff2
favicon.png
favicon.png-preview.png
fontawesome-all.css
index.html
logo-icon.png
logo-icon.png-preview.png
logo-text.png
logo-text.png-preview.png
materialdesignicons-webfont-1.eot
materialdesignicons-webfont.svg
materialdesignicons-webfont.ttf
materialdesignicons-webfont.woff
materialdesignicons-webfont.woff2
materialdesignicons.min.css
pe03MImSLYBIv1o4X1M8cc8aBc5iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8aBc5jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8aBc5tU1E.woff2
pe03MImSLYBIv1o4X1M8cc8GBs5iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8GBs5jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8GBs5tU1E.woff2
pe03MImSLYBIv1o4X1M8cc8WAc5iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8WAc5jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8WAc5tU1E.woff2
pe03MImSLYBIv1o4X1M8cc9iB85iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc9iB85jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc9iB85tU1E.woff2
pe0qMImSLYBIv1o4X1M8cce9I9s.woff2
pe0qMImSLYBIv1o4X1M8cceyI9tScg.woff2
pe0qMImSLYBIv1o4X1M8ccezI9tScg.woff2
style.css
style.min.css
themify-1.eot
themify-icons.css
themify.svg
themify.ttf
themify.woff
jquery.min.js
jquery.slim.min.js
installerdb.php
IPBam.txt
login.php
antibots
Bot-Crawler.php
Bot-neo.php
Dila_DZ.php
index.php
IP-BlackList.php
helpers
class
UserInfo.php
functions.php
loginx.php
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙