Deep Malware Analysis of e91dd8f635c1364a2255f027ea8a0be7 | md5: e91dd8f635c1364a2255f027ea8a0be7 | CAB:COMPRESSION:MSZIP | Office Document | PowerShell | T1059.001 | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	e91dd8f635c1364a2255f027ea8a0be7
Sha1	90f04968461467f0bfac8094f71f8941349b4edb
Sha256	9edfda3b77b3973f37708add497130d44cd88374c85812926f7974687006e3e5
Sha384	f0d90e2e32e5546da6b4987f9204ba481cd0995c509d8b6209dfdf31769bac006e3eea4fcffeac96d3c9543c28258546
Sha512	a38460cc13348ba40fd1cfb143e64ac0019b8f3e1cfc09632fb55acb4d5919e35c7d475a86b011f9c1520d21717cddb53a58240c52d628a91dacab4740e76f51
SSDeep	49152:TnhPvPvPvPvPv6ffffcoXSpmBH4AmLUR4D8C6VnH5ijZTSylVaa:PoFBHwARe8C6VniZ+WVZ
TLSH	15B54B636A50600542B1A8FABEBD5E37794F3409101AD98EFFD34B86F51E6F84802E1F

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path ole:doc>scr:ps1~T1027~T1059.001

Shape ole:doc>scr:ps1

malicious 2 nodes

Deobfuscated PowerShell UNKNWOWNmalicious

"$env:huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

"$env:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential