Suspicious
Suspect

e4e6bf358b6ac40296a8eebe11dad5f1

Share on LinkedIn
Print
Rar Archive
MD5: e4e6bf358b6ac40296a8eebe11dad5f1
Size: 27.01 MB
application/vnd.rar

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e4e6bf358b6ac40296a8eebe11dad5f1
Sha1 7f226d3e5fcde64bea76c6c108fc1f51305193f5
Sha256 5cfd0a7e817f523dc23ee80cf2ae1eac5497499a78795e4812cb25b4572f52e8
Sha384 8484f79596631925720e13367d82955428fabd8a32fbd559966bad437bb4571904d9d1bc9f65384f326fb94f96167f37
Sha512 fcccd6df84a051cd05433b9e3f791b4ef511aece21d53a8b64a27d3adfcccaba8fa89f0e0136e7a57c4ed917801948b2608b2691dad64c13ebda7706d880f506
SSDeep 786432:yFx8YIP7IJXR/fDci6W/Bs1/eT+rEwtLmQRFPu:yFmzIHf4Qs1/ZrRwGu
TLSH 2A4733DB613C8596CC24123FB92650C83CF4B824F8AAF93265C5465DEBB3F016549FBA
e4e6bf358b6ac40296a8eebe11dad5f1
Hit Fortune - Casino Slot.ipa
Payload
decrypt.day
hitFortune.app
LOGO_ICON_120.png
LOGO_ICON_120.png.exif
LOGO_ICON_120.png-preview.png
PlugIns
OneSignalWidgetExtension.appex
SC_Info
OneSignalWidgetExtension.supf
OneSignalWidgetExtension.v4.supp
OneSignalWidgetExtension.supp
OneSignalWidgetExtension.sinf
OneSignalWidgetExtension.supx
OneSignalWidgetExtension.v5.supf
_CodeSignature
CodeResources
Info.plist
Assets.car
OneSignalWidgetExtension
OneSignalNotificationServiceExtension.appex
SC_Info
OneSignalNotificationServiceExtension.v4.supp
OneSignalNotificationServiceExtension.supf
OneSignalNotificationServiceExtension.v5.supf
OneSignalNotificationServiceExtension.supp
_CodeSignature
CodeResources
OneSignalNotificationServiceExtension
Info.plist
AppIcon76x76@2x~ipad.png
AppIcon76x76@2x~ipad.png.exif
AppIcon76x76@2x~ipad.png-preview.png
UserConfigIOS.release.xcconfig
WebViewController.nib
Base.lproj
Localizable.strings
project.json
SC_Info
hitFortune.supp
hitFortune.v5.supf
hitFortune.v4.supp
hitFortune.supf
Manifest.plist
jsb-adapter
jsb-engine.js
jsb-builtin.js
hitFortune
_CodeSignature
CodeResources
LaunchScreenBackground.png
LaunchScreenBackground.png-preview.png
main.js
Frameworks
Sentry.framework
Sentry
SC_Info
Sentry.v4.supp
Sentry.supp
Sentry.supf
Sentry.v5.supf
_CodeSignature
CodeResources
Sentry.bundle
Info.plist
PrivacyInfo.xcprivacy
Info.plist
OneSignalUser.framework
SC_Info
OneSignalUser.v4.supp
OneSignalUser.supf
OneSignalUser.v5.supf
OneSignalUser.supp
_CodeSignature
CodeResources
OneSignalUser
Info.plist
PrivacyInfo.xcprivacy
OneSignalLiveActivities.framework
OneSignalLiveActivities
SC_Info
OneSignalLiveActivities.v5.supf
OneSignalLiveActivities.supp
OneSignalLiveActivities.v4.supp
OneSignalLiveActivities.supf
_CodeSignature
CodeResources
Info.plist
PrivacyInfo.xcprivacy
OneSignalExtension.framework
OneSignalExtension
SC_Info
OneSignalExtension.supf
OneSignalExtension.v5.supf
OneSignalExtension.supp
OneSignalExtension.v4.supp
_CodeSignature
CodeResources
Info.plist
FBSDKCoreKit_Basics.framework
SC_Info
FBSDKCoreKit_Basics.v4.supp
FBSDKCoreKit_Basics.supf
FBSDKCoreKit_Basics.supp
FBSDKCoreKit_Basics.v5.supf
_CodeSignature
CodeResources
FBSDKCoreKit_Basics
Info.plist
PrivacyInfo.xcprivacy
GoogleUtilities.framework
GoogleUtilities_Privacy.bundle
Info.plist
PrivacyInfo.xcprivacy
SC_Info
GoogleUtilities.v5.supf
GoogleUtilities.supp
GoogleUtilities.v4.supp
GoogleUtilities.supf
_CodeSignature
CodeResources
Info.plist
GoogleUtilities
OneSignalOutcomes.framework
SC_Info
OneSignalOutcomes.v5.supf
OneSignalOutcomes.supp
OneSignalOutcomes.v4.supp
OneSignalOutcomes.supf
_CodeSignature
CodeResources
OneSignalOutcomes
Info.plist
OneSignalFramework.framework
OneSignalFramework
SC_Info
OneSignalFramework.supp
OneSignalFramework.v5.supf
OneSignalFramework.supf
OneSignalFramework.v4.supp
_CodeSignature
CodeResources
Info.plist
PrivacyInfo.xcprivacy
AdjustSigSdk.framework
SC_Info
AdjustSigSdk.v4.supp
AdjustSigSdk.supp
AdjustSigSdk.v5.supf
AdjustSigSdk.supf
_CodeSignature
CodeResources
AdjustSigSdk
Info.plist
PrivacyInfo.xcprivacy
OneSignalOSCore.framework
SC_Info
OneSignalOSCore.supf
OneSignalOSCore.v4.supp
OneSignalOSCore.supp
OneSignalOSCore.v5.supf
_CodeSignature
CodeResources
OneSignalOSCore
Info.plist
PrivacyInfo.xcprivacy
nanopb.framework
SC_Info
nanopb.v4.supp
nanopb.supf
nanopb.v5.supf
nanopb.supp
_CodeSignature
CodeResources
Info.plist
nanopb_Privacy.bundle
Info.plist
PrivacyInfo.xcprivacy
nanopb
AppLovinSDK.framework
SC_Info
AppLovinSDK.supp
AppLovinSDK.v4.supp
AppLovinSDK.supf
AppLovinSDK.v5.supf
AppLovinSDK
_CodeSignature
CodeResources
AppLovinSDKResources.bundle
de.lproj
Localizable.strings
ALDDetailTableViewCell.nib
ja.lproj
Localizable.strings
MANativeAdMediaBannerView.nib
en.lproj
Localizable.strings
ALDRightDetailTableViewCell.nib
zh-Hant.lproj
Localizable.strings
es.lproj
Localizable.strings
MANativeAdMRecView.nib
ALDMultiAdViewController.storyboardc
ALDMultiAdViewController.nib
Info.plist
3jf-B1-XNL-view-Iqa-CO-DFs.nib
zh-Hans.lproj
Localizable.strings
MANativeAdVerticalBannerView.nib
OMLICENSE
MANativeAdVerticalLeaderView.nib
_CodeSignature
CodeRequirements-1
CodeSignature
CodeResources
CodeDirectory
CodeRequirements
ko.lproj
Localizable.strings
omsdk-v1.5.3.js
Info.plist
MANativeAdBannerView.nib
MANativeAdVerticalMediaBannerView.nib
MANativeAdLeaderView.nib
MANativeAdTemplate1.nib
fr.lproj
Localizable.strings
mute.aiff
Assets.car
ALConsentFlowUnifiedCMP.json
Info.plist
PrivacyInfo.xcprivacy
FBSDKCoreKit.framework
FBSDKCoreKit
SC_Info
FBSDKCoreKit.v5.supf
FBSDKCoreKit.supf
FBSDKCoreKit.supp
FBSDKCoreKit.v4.supp
_CodeSignature
CodeResources
Info.plist
PrivacyInfo.xcprivacy
FacebookSDKStrings.bundle
Resources
de.lproj
FacebookSDK.strings
he.lproj
FacebookSDK.strings
ar.lproj
FacebookSDK.strings
el.lproj
FacebookSDK.strings
ja.lproj
FacebookSDK.strings
mr.lproj
FacebookSDK.strings
en.lproj
FacebookSDK.strings
gu.lproj
FacebookSDK.strings
kn.lproj
FacebookSDK.strings
nb.lproj
FacebookSDK.strings
pt_PT.lproj
FacebookSDK.strings
pa.lproj
FacebookSDK.strings
es.lproj
FacebookSDK.strings
da.lproj
FacebookSDK.strings
it.lproj
FacebookSDK.strings
sk.lproj
FacebookSDK.strings
ms.lproj
FacebookSDK.strings
ta.lproj
FacebookSDK.strings
ml.lproj
FacebookSDK.strings
sv.lproj
FacebookSDK.strings
zh_Hant_TW.lproj
FacebookSDK.strings
te.lproj
FacebookSDK.strings
cs.lproj
FacebookSDK.strings
ko.lproj
FacebookSDK.strings
fil.lproj
FacebookSDK.strings
zh_Hant_HK.lproj
FacebookSDK.strings
hu.lproj
FacebookSDK.strings
tr.lproj
FacebookSDK.strings
pl.lproj
FacebookSDK.strings
es_ES.lproj
FacebookSDK.strings
vi.lproj
FacebookSDK.strings
ru.lproj
FacebookSDK.strings
af.lproj
FacebookSDK.strings
en_GB.lproj
FacebookSDK.strings
fr.lproj
FacebookSDK.strings
fi.lproj
FacebookSDK.strings
id.lproj
FacebookSDK.strings
nl.lproj
FacebookSDK.strings
th.lproj
FacebookSDK.strings
pt.lproj
FacebookSDK.strings
bn.lproj
FacebookSDK.strings
hr.lproj
FacebookSDK.strings
hi.lproj
FacebookSDK.strings
zh.lproj
FacebookSDK.strings
FBAEMKit.framework
SC_Info
FBAEMKit.v4.supp
FBAEMKit.supf
FBAEMKit.v5.supf
FBAEMKit.supp
_CodeSignature
CodeResources
Info.plist
PrivacyInfo.xcprivacy
FBAEMKit
OneSignalNotifications.framework
SC_Info
OneSignalNotifications.supp
OneSignalNotifications.v4.supp
OneSignalNotifications.supf
OneSignalNotifications.v5.supf
_CodeSignature
CodeResources
Info.plist
PrivacyInfo.xcprivacy
OneSignalNotifications
OneSignalCore.framework
OneSignalCore
SC_Info
OneSignalCore.supf
OneSignalCore.v4.supp
OneSignalCore.supp
OneSignalCore.v5.supf
_CodeSignature
CodeResources
Info.plist
AdjustSdk.framework
AdjustSdk
SC_Info
AdjustSdk.supp
AdjustSdk.v4.supp
AdjustSdk.supf
AdjustSdk.v5.supf
_CodeSignature
CodeResources
Adjust.bundle
Info.plist
PrivacyInfo.xcprivacy
Info.plist
libwebp.framework
SC_Info
libwebp.v5.supf
libwebp.supp
libwebp.v4.supp
libwebp.supf
_CodeSignature
CodeResources
libwebp
Info.plist
Info.plist
AppsFlyerLib_Privacy.bundle
Info.plist
PrivacyInfo.xcprivacy
PkgInfo
Assets.car
assets
resources
native
a4
a4a1c4dd-9289-4170-b070-629bcdc0e575
afont.ttf
a6
a61bf9b6-49df-4a2b-8c68-979b3157c14e.png
a61bf9b6-49df-4a2b-8c68-979b3157c14e.png-preview.png
77
77299218-72ed-4888-8a38-fc0e8a1565fe.jpg
77299218-72ed-4888-8a38-fc0e8a1565fe.jpg.exif
77299218-72ed-4888-8a38-fc0e8a1565fe.jpg-preview.png
config.json
index.jsc
import
a4
a4a1c4dd-9289-4170-b070-629bcdc0e575.json
ac
acce4c92-39f4-4e1c-9f74-753ed21b3123.json
a6
a61bf9b6-49df-4a2b-8c68-979b3157c14e.json
77
77299218-72ed-4888-8a38-fc0e8a1565fe.json
84
84234e05-6238-4039-9fe4-63d84bc0cae8.json
internal
native
02
0275e94c-56a7-410f-bd1a-fc7483f7d14a.png
0275e94c-56a7-410f-bd1a-fc7483f7d14a.png-preview.png
config.json
import
09
0967b326a.json
main
config.json
index.jsc
import
07
074caebb7.json
UserConfigIOS.debug.xcconfig
AppIcon60x60@2x.png
AppIcon60x60@2x.png.exif
AppIcon60x60@2x.png-preview.png
src
settings.jsc
assets
Lib
SkeletonExt.jsc
fairygui.jsc
qrcode.jsc
cocos2d-jsb.jsc
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3
img 2bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:rar>arc:zip>html
Shape arc:rar>arc:zip>html
3 nodes
An error has occurred. This application may no longer respond until reloaded. Reload 🗙