Deep Malware Analysis of d6a821073d27b37e03c454cf07133c25 | md5: d6a821073d27b37e03c454cf07133c25 | CAB:COMPRESSION:MSZIP | Office Document | T1059.001 | T1027 | DeObfuscated | PowerShell

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	d6a821073d27b37e03c454cf07133c25
Sha1	df6f899e354a8d21ac1624f8c8d76c1ab39a55f9
Sha256	71c82600ba9317937bad0da87ebcdf0a4ed9bb364fccf640ba2ed8fa49a79f3f
Sha384	4fabfc89ee0b7439508e4126be9187ca22937068ef23f13f372ceb45154915aa4d7040f3995bdba804d4cf0579d2a788
Sha512	aa2b5a8ddc9388d24aead3013fd51a44a6cb6b6f6fbff559ae799d6e8a47714bb8337cf667379368ea2dec763553b11fc072ccb953370ed253a570126798431d
SSDeep	24576:hfxK1PcpukylEL3CJEdBPHjzWO1UauftimpvpYe0DZp52lHF6Y5mJYAppfSKMxAR:hQSdDSidBLZUamiuX0Df52lMUllUB
TLSH	67B54C636A50600642B5A8FABEBD5E37795F340D101AD98EFFD30B86E51E6F44802E1F

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path ole:doc>scr:ps1~T1027~T1059.001

Shape ole:doc>scr:ps1

malicious 2 nodes

Deobfuscated PowerShell UNKNWOWNmalicious

"$env:huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

"$env:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential