Deep Malware Analysis of f67dfd946375a0cc1de799cff89846c1 | md5: f67dfd946375a0cc1de799cff89846c1 | Executable | PE (Portable Executable) | PE File Layout | Win 32 Exe | x86 | T1059.001 | PowerShell

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	f67dfd946375a0cc1de799cff89846c1
Sha1	65c1000e6c6954d1fb4803b04e847a4a29801e34
Sha256	3057fa7d5414cd79f6551bd975ba143d15fefdfc75606f09ac49fe5193ec1cd0
Sha384	3fb7246bb269519b7a51d5df7b758ccfc51d4cce00d0f72844aa680b28ead6282a01ada189c982da576bf3dd478fe39d
Sha512	67d466ea0a1a3e5f82b4a04073629fa04e750c090e3244e6dc4df528d11b008de89e2d0d2b9f28a8c570d9a2800e5f9ab4eb3bafe6216125007d71b2f636c3b7
SSDeep	49152:/aLEUejR42lJBApUSIATv1HBxlvd/5hME/K1hx:/zjR42lzApIAhL/5jI
TLSH	F1C5BF50BB40C064D8637F361E3B956849B37DA06930D96F66AE37FE09355A0DE20FB2

PeID

Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamUPolyX 0.3 -> delikon

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>scr:ps1~T1059.001

Shape pe:exe>scr:ps1

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_68c35161.bin (1419440 bytes)