Malicious
Malicious

62041f1c3ddb1d708abd4364665d4591941c5af779[...]cb3

AutoIt Compiled Script
MD5: f6ac6f09f7ea252953990d5499bf68ad
Size: 2.83 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 f6ac6f09f7ea252953990d5499bf68ad
Sha1 ff713638832849067a5c43c1ec78b0efe9802717
Sha256 62041f1c3ddb1d708abd4364665d4591941c5af7797165a43cca34a3e0cf8cb3
Sha384 6f1eb47ff1a7b5e18b0b8474f82a2f07ef864abe729ab3aec117b8c0084992f099717540aedbc5fa34c8d361d109a882
Sha512 f59a9304be70de250eb878502d081a2d68da3b6b1cdbe51fc2c747d0334ef852de56d958ee797b678f146af7d6b5a2ba1766dcf74056eee503d25286a616fc7f
SSDeep 49152:AM3RMn+CnxLFaozPp4NE88c2TL8HoBW0VOnNfo4hDc+J+Hl1KH0PHQ2R4avMT:HBAnxLFzPp4NE88c2TgHyb0NzhDcyKUV
TLSH 31D5E102F7818062FFB39277CA6EF23557BC7D2D42238A6F12982C797D341B2565D262
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
62041f1c3ddb1d708abd4364665d4591941c5af7797165a43cca34a3e0cf8cb3
Malicious
autF43A.tmp.tok
Malicious
Overlay_8d8bec38.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:2057
ID:0002
ID:2057
ID:0003
ID:2057
ID:0004
ID:2057
ID:0005
ID:2057
ID:0006
ID:2057
ID:0007
ID:2057
ID:0008
ID:2057
ID:0009
ID:2057
RT_MENU
ID:00A6
ID:2057
RT_STRING
ID:0007
ID:2057
ID:0008
ID:2057
ID:0009
ID:2057
ID:000A
ID:2057
ID:000B
ID:2057
ID:000C
ID:2057
ID:0139
ID:2057
RT_RCDATA
ID:0000
OtherSounds
DisablePause_Info.mp3
DisablePause_scope.mp3
DisablePause_weapon.mp3
Pictures
AKM.png-preview.png
AUG.png-preview.png
DP28.png-preview.png
GROZA.png
GROZA.png-preview.png
M16A4.png
M16A4.png-preview.png
M249.png-preview.png
M416.png-preview.png
M762.png-preview.png
MICROUZI.png
MICROUZI.png-preview.png
MINI14.png
MINI14.png-preview.png
MK14.png-preview.png
none.png-preview.png
QBU.png-preview.png
QBZ.png-preview.png
RDS.png-preview.png
SCARL.png
SCARL.png-preview.png
SKS.png-preview.png
SLR.png-preview.png
TOMMYGUN.png
TOMMYGUN.png-preview.png
UMP9.png-preview.png
VECTOR.png
VECTOR.png-preview.png
VSS.png-preview.png
X2.png-preview.png
X3.png-preview.png
X4.png-preview.png
X6.png-preview.png
X8.png-preview.png
weapons
Groza.mp3
M16A4.mp3
MICROUZI.mp3
MINI14.mp3
SCARL.mp3
TOMMYGUN.mp3
VECTOR.mp3
RT_GROUP_CURSOR4
ID:0063
ID:2057
ID:00A2
ID:2057
ID:00A4
ID:2057
ID:00A9
ID:2057
RT_VERSION
ID:0001
ID:2057
RT_MANIFEST
ID:0001
ID:2057
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 2secondary ignored: 4
bin 3img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:autoit
Shape pe:exe>pe:autoit
malicious 2 nodes
Path pe:exe>pe:rsrc>pe:autoit
Shape pe:exe>pe:rsrc>pe:autoit
3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_8d8bec38.bin (66264 bytes)
Info
PDB Path: ????
62041f1c3ddb1d708abd4364665d4591941c5af7797165a43cca34a3e0cf8cb3
Malicious
autF43A.tmp.tok
Malicious
Overlay_8d8bec38.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:2057
ID:0002
ID:2057
ID:0003
ID:2057
ID:0004
ID:2057
ID:0005
ID:2057
ID:0006
ID:2057
ID:0007
ID:2057
ID:0008
ID:2057
ID:0009
ID:2057
RT_MENU
ID:00A6
ID:2057
RT_STRING
ID:0007
ID:2057
ID:0008
ID:2057
ID:0009
ID:2057
ID:000A
ID:2057
ID:000B
ID:2057
ID:000C
ID:2057
ID:0139
ID:2057
RT_RCDATA
ID:0000
OtherSounds
DisablePause_Info.mp3
DisablePause_scope.mp3
DisablePause_weapon.mp3
Pictures
AKM.png-preview.png
AUG.png-preview.png
DP28.png-preview.png
GROZA.png
GROZA.png-preview.png
M16A4.png
M16A4.png-preview.png
M249.png-preview.png
M416.png-preview.png
M762.png-preview.png
MICROUZI.png
MICROUZI.png-preview.png
MINI14.png
MINI14.png-preview.png
MK14.png-preview.png
none.png-preview.png
QBU.png-preview.png
QBZ.png-preview.png
RDS.png-preview.png
SCARL.png
SCARL.png-preview.png
SKS.png-preview.png
SLR.png-preview.png
TOMMYGUN.png
TOMMYGUN.png-preview.png
UMP9.png-preview.png
VECTOR.png
VECTOR.png-preview.png
VSS.png-preview.png
X2.png-preview.png
X3.png-preview.png
X4.png-preview.png
X6.png-preview.png
X8.png-preview.png
weapons
Groza.mp3
M16A4.mp3
MICROUZI.mp3
MINI14.mp3
SCARL.mp3
TOMMYGUN.mp3
VECTOR.mp3
RT_GROUP_CURSOR4
ID:0063
ID:2057
ID:00A2
ID:2057
ID:00A4
ID:2057
ID:00A9
ID:2057
RT_VERSION
ID:0001
ID:2057
RT_MANIFEST
ID:0001
ID:2057
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙