Malicious
PE Executable
MD5: eef3cf31bb13fdc60ef08cd45379392d
Size: 200.7 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
200.7 KB · 200,704 B
First seen
2026-06-26 01:01 · 4 months ago
Last seen
2026-06-26 01:01 · 4 months ago
Last analysis
2026-06-27 04:27 · 4 months ago
Hashes
MD5
eef3cf31bb13fdc60ef08cd45379392d
Sha1
b6aff94a80c60bac2a5e611d60e636603b5ce7d9
Sha256
e2167e5191c46e91b9a73fe36e18f8be93bdabb0435975b61925b26930e3ca7c
Sha384
2252864f5c5b1c6af354371195680f420205fcf2d498aa0c9571d6b4f035477ab12d357794f2734b9d3b476ebbe85435
Sha512
35e06ccc5ef30edcebfbc094b492b016c8f12e3d1596da3ccf76e919b4b5928a7bd7c652b5afcdb74ec488aa8c7056f231d0151d4a996969a8be7c5d1d1424e5
SSDeep
3072:/RLiJRaxQRsgLY1c5GWp1icKAArDZz4N9GhbkrNEkkZFbxwy:c3axQpFp0yN90QE1v
TLSH
4E146B0923E91192F4B26B7099F602834E367CA3AB7582FF1784957E0D33AC49975F63
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)
17 malicious · 63 files
EXEeef3cf31bb13fdc60ef08cd45379392dT1059.005
Structure
BINResources
VBSCryptoClipper.vbsT1059.005
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Base64-Block]
VBSCryptoClipper.vbs.deobfuscated.vbsT1059.005
SH[Command #0]
SH[Command #1]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
| Name | Value |
|---|---|
| Info | PDB Path: wextract.pdb |
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
httphuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& var_huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
silenthuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
psfilehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential