Malicious
eef3cf31bb13fdc60ef08cd45379392d
PE Executable
MD5: eef3cf31bb13fdc60ef08cd45379392d
Size: 200.7 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
200.7 KB · 200,704 B
First seen
2026-06-26 01:01 · 4 months ago
Last seen
2026-06-26 01:01 · 4 months ago
Last analysis
2026-06-27 04:27 · 4 months ago
Hashes
MD5
eef3cf31bb13fdc60ef08cd45379392d
Sha1
b6aff94a80c60bac2a5e611d60e636603b5ce7d9
Sha256
e2167e5191c46e91b9a73fe36e18f8be93bdabb0435975b61925b26930e3ca7c
Sha384
2252864f5c5b1c6af354371195680f420205fcf2d498aa0c9571d6b4f035477ab12d357794f2734b9d3b476ebbe85435
Sha512
35e06ccc5ef30edcebfbc094b492b016c8f12e3d1596da3ccf76e919b4b5928a7bd7c652b5afcdb74ec488aa8c7056f231d0151d4a996969a8be7c5d1d1424e5
SSDeep
3072:/RLiJRaxQRsgLY1c5GWp1icKAArDZz4N9GhbkrNEkkZFbxwy:c3axQpFp0yN90QE1v
TLSH
4E146B0923E91192F4B26B7099F602834E367CA3AB7582FF1784957E0D33AC49975F63
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)
17 malicious · 63 files
EXEeef3cf31bb13fdc60ef08cd45379392dT1059.005
Structure
BINResources
BINAVI
BINID:0BB9
BINID:1033
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
IMGID:1033
IMGID:1033-preview.png
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINRT_DIALOG
BINID:07D1
BINID:1033
BINID:1036
BINID:07D2
BINID:1033
BINID:1036
BINID:07D3
BINID:1033
BINID:1036
BINID:07D4
BINID:1033
BINID:1036
BINID:07D5
BINID:1033
BINID:1036
BINID:07D6
BINID:1033
BINID:1036
BINRT_STRING
BINID:003F
BINID:1033
BINID:1036
BINID:004C
BINID:1033
BINID:1036
BINID:004D
BINID:1033
BINID:1036
BINID:0050
BINID:1033
BINID:1036
BINID:0053
BINID:1033
BINID:1036
BINID:0055
BINID:1033
BINID:1036
BINRT_RCDATA
BINID:0000
BINID:1033
BINID:1036
BINRT_GROUP_CURSOR4
BINID:0BB8
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINID:1036
BINRT_MANIFEST
BINID:0001
BINID:1033
VBSCryptoClipper.vbsT1059.005
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Base64-Block]
VBSCryptoClipper.vbs.deobfuscated.vbsT1059.005
SH[Command #0]
SH[Command #1]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
| Name | Value |
|---|---|
| Info | PDB Path: wextract.pdb |
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
httphuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& var_huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
silenthuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
psfilehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential17 malicious · 63 files
EXEeef3cf31bb13fdc60ef08cd45379392dT1059.005
Structure
BINResources
VBSCryptoClipper.vbsT1059.005
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Base64-Block]
VBSCryptoClipper.vbs.deobfuscated.vbsT1059.005
SH[Command #0]
SH[Command #1]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
eef3cf31bb13fdc60ef08cd45379392d › CryptoClipper.vbs
URLs in VB Code - #2
URIsuspect
httphuhuhuhuhuhuhu
eef3cf31bb13fdc60ef08cd45379392d › CryptoClipper.vbs
Deobfuscated PowerShell
UNKNWOWNmalicious
& var_huhuhuhuhuhuhuhuhuhuhu
eef3cf31bb13fdc60ef08cd45379392d › CryptoClipper.vbs › CryptoClipper.vbs.deobfuscated.vbs › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
eef3cf31bb13fdc60ef08cd45379392d › CryptoClipper.vbs › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
silenthuhuhuhuhuhuhuhuhuhuhu
eef3cf31bb13fdc60ef08cd45379392d › CryptoClipper.vbs › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
eef3cf31bb13fdc60ef08cd45379392d › CryptoClipper.vbs › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
psfilehuhuhuhuhuhuhuhuhuhuhu
eef3cf31bb13fdc60ef08cd45379392d › CryptoClipper.vbs › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account