Deep Malware Analysis of ecc825caa8479ed1ad7e83ad9c8ab5e6 | md5: ecc825caa8479ed1ad7e83ad9c8ab5e6 | CAB:COMPRESSION:MSZIP | Office Document | T1059.001 | T1027 | DeObfuscated | PowerShell

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	ecc825caa8479ed1ad7e83ad9c8ab5e6
Sha1	bfa95331a132162257994b4323f521d0167fb9db
Sha256	1948744d57d7a91b585031df5e3c3a5f911811ca0c010594b9b851f904a06ad4
Sha384	b5e33ca62c1d48994554f1d217a1d95118827efeb5772800e6d3c760a380b9fa448139c2edb672a5db79fc134f70752c
Sha512	8f9b28029c020da9d7e21b9b014630de20d04359775bea96752ce12bc66b9532b5e713c80566f16da77ff6a06849efbe82dc742a20478ea9fdffe35aa6938246
SSDeep	768:bpydEHnOhAevH4nCFShnL0IeWMbCSPzN/nq:gmHOhAWFFShnIIobO
TLSH	05D27D46F941C332CA815B325B5BD7F48F36AC55DF932003369AB34C2E729A02AB75E0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path ole:doc>scr:ps1~T1027~T1059.001

Shape ole:doc>scr:ps1

malicious 2 nodes

Path ole:doc>scr:ps1

Shape ole:doc>scr:ps1

2 nodes

Deobfuscated PowerShell UNKNWOWNmalicious

param(huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential