e93b26f646d3a9bc0354e28a99143633

ZIP Archive

MD5: e93b26f646d3a9bc0354e28a99143633

Size: 294 B

application/zip

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	e93b26f646d3a9bc0354e28a99143633
Sha1	54f935dd9261657dd4138115e27586a825c0c336
Sha256	d9be0106ce0c7ccc6117dc224ec7bffba09c27e0dc6b93f1a5106688f0486d1f
Sha384	d1c76e4fa0dacdc6d3fc29a4b5c43692988f3bd5f2e4b927dccd1b6d97d970ce83f5c4ffe870e28c36f5b7ac5af07960
Sha512	cc4f0a29378bad1c3c48064258f5f5afa49759fa2433dfcfed0ff65b90a3c9d40f3ab88d4576202500804812d8f3b2599dd49c6e641e19d5d3b8f17ad6db19fa
SSDeep	6:5jeTj+XPKBKps588L1vmw9/TF/Fgg2+H+e541YmWzo0eTu+XPKBKet+lEH:5j4j+XyBKp1cew9/pKX+eYsdu+XyBKKl
TLSH	24E02BB283B874A4E737CA3F9D8F0B99060C34820001815B675440809C90242C9156D6

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>scr:vbs~T1027~T1059~T1059.005

Shape arc:zip>scr:vbs

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

msihuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

msihuhuhuhu

e93b26f646d3a9bc0354e28a99143633 › WebexInstaller-Windows.vbs

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

e93b26f646d3a9bc0354e28a99143633 › WebexInstaller-Windows.vbs

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

e93b26f646d3a9bc0354e28a99143633 › WebexInstaller-Windows.vbs

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.