Suspicious
Suspect

d4bdb3a3f621a1830546419e1980a381

Share on LinkedIn
Print
ZIP Archive
MD5: d4bdb3a3f621a1830546419e1980a381
Size: 3.87 MB
application/zip

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d4bdb3a3f621a1830546419e1980a381
Sha1 3b131c3a6064c1a457e7b8384ce8b541edf7209e
Sha256 b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b
Sha384 3c75d228da138ab5422b5dee21cc148a085e3fc3da96336ed841766df16124cb5e0d4a49c4d81ff5e1e2927d520333e6
Sha512 031b182e3f03f0c1d3b87f691902cb5fd29608c6cb03bcd2f92ba8ff4be7e148b74f0a40b4beafe9a7c05e671330854627d2177f532652528c3094b8c8d50f3f
SSDeep 98304:1mBzF2zK+m1nDjnukH2L7mDhiJlJpAgIqnmbO5w:kIK+GDjukH2el0AcnW
TLSH E506338A40763610E9E1F2BC91AE676FDAD758E13175F93F0969F4000E7A89A5B30337
d4bdb3a3f621a1830546419e1980a381
static
check_5610944.png
check_5610944.png-preview.png
COB-BOB-IRT-enroll_tractor.jpg
COB-BOB-IRT-enroll_tractor.jpg.exif
COB-BOB-IRT-enroll_tractor.jpg-preview.png
Interdiction.bb46a732e12eabdef3c0.chunk.css
js
jquery-3.7.1.min.js
ui_card.js
ui_emailotp.js
ui_logon - copia.js
ui_logon.js
ui_otpsms.js
ui_wireless.js
main.6539fceb73733687f14d.css
main.7e149a8530327875d4f8.css
[Base64-Block@0x0000355F]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x00003FC9]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x00005C46]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x00005E6C]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x0000624A]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x000082CA]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x00008DF1]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x000092F1]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.jpg
[Base64-Block@0x0003006A]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
[Base64-Block@0x0003105C]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
src_app_page_login_Login_js.7bcb9ada66a4959d7c4c.chunk.css
wellsfargosans-rg.woff
wellsfargosans-rg.woff2
wellsfargosans-sbd.woff
wellsfargosans-sbd.woff2
wellsfargoserif-rg.woff
wellsfargoserif-rg.woff2
wfui.6362463d530db2fe67a3.css
wfui.8371e772fb2cafb2a7d0.css
.htaccess
config.php
index.php
sing_on.php
0x00004128.svg
0x0000899C.svg
0x0000899C.svg-preview.jpg
0x0001354E.svg
0x0001354E.svg-preview.jpg
0x00019CFD.svg
0x00019CFD.svg-preview.jpg
0x0001C94E.svg
0x0001C94E.svg-preview.jpg
0x00023DB6.svg
0x00023DB6.svg-preview.jpg
0x0003638E.svg
0x0003638E.svg-preview.jpg
0x0003A722.svg
0x0003A722.svg-preview.jpg
0x00046113.svg
0x00046113.svg-preview.jpg
verified.php
wait.php
0x000271A2.svg
0x000271A2.svg-preview.jpg
wireless.php
0x000047EB.svg
0x000047EB.svg-preview.jpg
0x0003BD3E.svg
0x0003BD3E.svg-preview.jpg
admintus
backend.php
config
dist
css
1.jpg-preview.png
custom-select.png
custom-select.png-preview.png
fa-brands-400-1.eot
fa-brands-400.svg
fa-brands-400.svg
0x00000140.svg
fa-brands-400.ttf
fa-brands-400.woff
fa-brands-400.woff2
fa-regular-400-1.eot
fa-regular-400.svg
fa-regular-400.svg
0x00000140.svg
fa-regular-400.ttf
fa-regular-400.woff
fa-regular-400.woff2
fa-solid-900-1.eot
fa-solid-900.svg
fa-solid-900.svg
0x00000140.svg
fa-solid-900.ttf
fa-solid-900.woff
fa-solid-900.woff2
favicon.png
favicon.png-preview.png
fontawesome-all.css
index.html
logo-icon.png
logo-icon.png-preview.png
logo-text.png
logo-text.png-preview.png
materialdesignicons-webfont-1.eot
materialdesignicons-webfont.svg
materialdesignicons-webfont.ttf
materialdesignicons-webfont.woff
materialdesignicons-webfont.woff2
materialdesignicons.min.css
pe03MImSLYBIv1o4X1M8cc8aBc5iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8aBc5jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8aBc5tU1E.woff2
pe03MImSLYBIv1o4X1M8cc8GBs5iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8GBs5jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8GBs5tU1E.woff2
pe03MImSLYBIv1o4X1M8cc8WAc5iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8WAc5jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc8WAc5tU1E.woff2
pe03MImSLYBIv1o4X1M8cc9iB85iU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc9iB85jU1EQVg.woff2
pe03MImSLYBIv1o4X1M8cc9iB85tU1E.woff2
pe0qMImSLYBIv1o4X1M8cce9I9s.woff2
pe0qMImSLYBIv1o4X1M8cceyI9tScg.woff2
pe0qMImSLYBIv1o4X1M8ccezI9tScg.woff2
style.css
style.min.css
themify-1.eot
themify-icons.css
themify.svg
themify.ttf
themify.woff
jquery.min.js
jquery.slim.min.js
installerdb.php
IPBam.txt
login.php
antibots
Bot-Crawler.php
Bot-neo.php
Dila_DZ.php
index.php
IP-BlackList.php
helpers
class
UserInfo.php
functions.php
loginx.php
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5
img 4bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>html>enc:b64
Shape arc:zip>html>enc:b64
3 nodes
Path arc:zip>html
Shape arc:zip>html
2 nodes
An error has occurred. This application may no longer respond until reloaded. Reload 🗙