Malicious
Malicious

e9587b23f22fd7052bf581b1bb234445

Share on LinkedIn
Print
ZIP Archive
MD5: e9587b23f22fd7052bf581b1bb234445
Size: 18.92 MB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e9587b23f22fd7052bf581b1bb234445
Sha1 7fcb59d73a1038b1cdcf243422e0a9b30c81e8b7
Sha256 afee86ae2e8a4841dd46270443d419a4c270ab5f19f5ca6acf88ba8419eb36dc
Sha384 1ee8b1cd2df86725ff4ed6cf06d43392af55f4b509a84f7189737e74a44bd3efc15f69870f12eda851c2846008279728
Sha512 0439573ab2e5e7aa2ac52ac04e62b319c59bac035f98a08289bd9a7c7019b46e5321971c433dbfdf99887038bc63a222eca3e377fd24e8f6185fe36bc965bb1e
SSDeep 393216:oYi67w6w3f4KGtXt7I1ihOZXgm8D89Ld7wkqmVEpIyRWRF7zzgsKMhrmWi:Lwff4KGtd8gmC89BUOGpI9FXcsKMhqJ
TLSH 3A173347A4651F51C81D167882DF4B9623989F9A006BE71F0738E2ABBFF73F0A611E05
e9587b23f22fd7052bf581b1bb234445
Malicious
Fonts
Type1
c0632bt_.pfa
c0633bt_.pfa
c0648bt_.pfa
c0649bt_.pfa
cour.pfa
courb.pfa
courbi.pfa
couri.pfa
fonts.alias
fonts.dir
PSres.upr
Swiss721BT-Bold.pfa
Swiss721BT-BoldItalic.pfa
Swiss721BT-Italic.pfa
Swiss721BT-Roman.pfa
UTBI____.pfa
UTB_____.pfa
UTI_____.pfa
UTRG____.pfa
TrueType
AlegreyaSC-Black.ttf
AlegreyaSC-BlackItalic.ttf
AlegreyaSC-Bold.ttf
AlegreyaSC-BoldItalic.ttf
AlegreyaSC-Italic.ttf
AlegreyaSC-Regular.ttf
ClearSans-Bold.ttf
ClearSans-BoldItalic.ttf
ClearSans-Italic.ttf
ClearSans-Light.ttf
ClearSans-Thin.ttf
Cousine-BoldItalic.ttf
Cousine-Italic.ttf
DroidSerif-Bold.ttf
DroidSerif-BoldItalic.ttf
DroidSerif-Italic.ttf
DroidSerif.ttf
EBGaramond08-Italic.ttf
EBGaramond08-Regular.ttf
EBGaramond12-AllSC.ttf
EBGaramondSC08-Regular.ttf
Economica-Bold.ttf
Economica-BoldItalic.ttf
Economica-Italic.ttf
Economica-Regular.ttf
Felipa-Regular.ttf
GenBasB.ttf
GenBasBI.ttf
GenBasI.ttf
GenBasR.ttf
Inconsolata-Bold.ttf
Inconsolata-Regular.ttf
Lato-Black.ttf
Lato-BlackItalic.ttf
Lato-Bold.ttf
Lato-BoldItalic.ttf
Lato-Hairline.ttf
Lato-HairlineItalic.ttf
Lato-Italic.ttf
Lato-Light.ttf
Lato-LightItalic.ttf
Lato-Regular.ttf
LeagueGothic-CondensedItalic.otf
LeagueGothic-CondensedRegular.otf
LeagueGothic-Italic.otf
LeagueGothic-Regular.otf
Mathematica-Bold.ttf
Mathematica.ttf
MathematicaMono-Bold.ttf
MathematicaMono.ttf
MathematicaSans-Bold.ttf
MathematicaSans.ttf
Oswald-Bold.ttf
Oswald-Light.ttf
Oswald-Regular.ttf
PlayfairDisplay-Black.ttf
PlayfairDisplay-BlackItalic.ttf
PlayfairDisplay-Bold.ttf
PlayfairDisplay-BoldItalic.ttf
PlayfairDisplay-Italic.ttf
PlayfairDisplay-Regular.ttf
Roboto-Black.ttf
Roboto-BlackItalic.ttf
Roboto-Bold.ttf
Roboto-BoldItalic.ttf
Roboto-Italic.ttf
Roboto-Light.ttf
Roboto-LightItalic.ttf
Roboto-Medium.ttf
Roboto-MediumItalic.ttf
Roboto-Regular.ttf
Roboto-Thin.ttf
Roboto-ThinItalic.ttf
RobotoCondensed-Bold.ttf
RobotoCondensed-BoldItalic.ttf
RobotoCondensed-Italic.ttf
RobotoCondensed-Light.ttf
RobotoCondensed-LightItalic.ttf
RobotoCondensed-Regular.ttf
RobotoSlab-Bold.ttf
RobotoSlab-Light.ttf
RobotoSlab-Regular.ttf
RobotoSlab-Thin.ttf
ShadowsIntoLightTwo-Regular.ttf
SourceCodePro-Black.ttf
SourceCodePro-Bold.ttf
SourceCodePro-ExtraLight.ttf
SourceCodePro-Light.ttf
SourceCodePro-Medium.ttf
SourceCodePro-Regular.ttf
SourceCodePro-Semibold.ttf
SourceSansCode-Regular.ttf
SourceSansCode-Semibold.ttf
SourceSansPro-Black.ttf
SourceSansPro-BlackItalic.ttf
SourceSansPro-Bold.ttf
SourceSansPro-BoldItalic.ttf
SourceSansPro-ExtraLight.ttf
SourceSansPro-ExtraLightItalic.ttf
SourceSansPro-Italic.ttf
SourceSansPro-Light.ttf
SourceSansPro-LightItalic.ttf
SourceSansPro-Regular.ttf
SourceSansPro-Semibold.ttf
SourceSansPro-SemiboldItalic.ttf
SourceSerifPro-Bold.ttf
SourceSerifPro-Regular.ttf
SourceSerifPro-Semibold.ttf
SVG
ClearSans-Bold.svg
ClearSans-BoldItalic.svg
ClearSans-Italic.svg
ClearSans-Light.svg
ClearSans-Medium.svg
ClearSans-MediumItalic.svg
ClearSans-Regular.svg
ClearSans-Thin.svg
Mathematica-Bold.svg
Mathematica.svg
MathematicaMono-Bold.svg
MathematicaMono.svg
MathematicaSans-Bold.svg
MathematicaSans.svg
TitilliumWeb-Black.ttf
TitilliumWeb-Bold.ttf
TitilliumWeb-BoldItalic.ttf
TitilliumWeb-ExtraLight.ttf
TitilliumWeb-ExtraLightItalic.ttf
TitilliumWeb-Italic.ttf
TitilliumWeb-Light.ttf
TitilliumWeb-LightItalic.ttf
TitilliumWeb-Regular.ttf
TitilliumWeb-SemiBold.ttf
TitilliumWeb-SemiBoldItalic.ttf
VeraMono-Bold-Italic.ttf
VeraMono-Bold.ttf
VeraMono-Italic.ttf
VeraMono.ttf
WolframModern-Bold.ttf
WolframModern.ttf
YanoneKaffeesatz-Bold.otf
YanoneKaffeesatz-ExtraLight.otf
YanoneKaffeesatz-Light.otf
YanoneKaffeesatz-Regular.otf
Azure.Storage.Blobs.dll
[Authenticode]_c37747c6.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
mfmpsnk.dll
python37.dll
Malicious
Overlay_2cf8140c.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:1033-preview.png
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
RT_STRING
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:1033
[Authenticode]_3a3e5b36.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:000F
ID:0
ID:0010
ID:0
ID:0011
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1033
ID:0
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Setup.exe
[Authenticode]_8a74c34a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.gfids
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
vcruntime140.dll
[Authenticode]_71d478a4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Default
DefaultDevice.m
Devices
3Dconnexion
Navigator.m
Traveler.m
Common
CompoundAxes.m
KnownAxes.m
UnknownAxes.m
DeviceDrivers
Camera.m
Demos
AsynchronousDemo.m
DefaultShellCommandDemo.m
DelayedRandomSignalDemo.m
FunctionDemo.m
PropertiesDemo.m
RandomSignalDemo.m
SerialAsynchronousDemo.m
ShellCommandDemo.m
SingletonDemo.m
StreamsDemo.m
WriteDemo.m
OpenAIGym.m
Serial.m
SimulatedCartPole.m
TinkerForgeWeatherStation.m
Logitech
DualAction.m
Freedom.m
RumblePad.m
Other
Aftershock.m
Airflo.m
AppleIR.m
Omni.m
USBJoystick.m
XBox.m
Saitek
P880.m
Dictionaries
English
dictionary.txt
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
11 / 11
Path arc:zip>pe:dll>pe:rsrc>pe:exe>pe:rsrc>img
Shape arc:zip>pe:dll>pe:rsrc>pe:exe>pe:rsrc>img
malicious 6 nodes
Path arc:zip>pe:dll>pe:rsrc>pe:exe>pe:rsrc>bin
Shape arc:zip>pe:dll>pe:rsrc>pe:exe>pe:rsrc>bin
malicious 6 nodes
An error has occurred. This application may no longer respond until reloaded. Reload 🗙