Malicious
Malicious

62041f1c3ddb1d708abd4364665d4591941c5af779[...]cb3

Share on LinkedIn
Print
AutoIt Compiled Script
MD5: f6ac6f09f7ea252953990d5499bf68ad
Size: 2.83 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 f6ac6f09f7ea252953990d5499bf68ad
Sha1 ff713638832849067a5c43c1ec78b0efe9802717
Sha256 62041f1c3ddb1d708abd4364665d4591941c5af7797165a43cca34a3e0cf8cb3
Sha384 6f1eb47ff1a7b5e18b0b8474f82a2f07ef864abe729ab3aec117b8c0084992f099717540aedbc5fa34c8d361d109a882
Sha512 f59a9304be70de250eb878502d081a2d68da3b6b1cdbe51fc2c747d0334ef852de56d958ee797b678f146af7d6b5a2ba1766dcf74056eee503d25286a616fc7f
SSDeep 49152:AM3RMn+CnxLFaozPp4NE88c2TL8HoBW0VOnNfo4hDc+J+Hl1KH0PHQ2R4avMT:HBAnxLFzPp4NE88c2TgHyb0NzhDcyKUV
TLSH 31D5E102F7818062FFB39277CA6EF23557BC7D2D42238A6F12982C797D341B2565D262
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
62041f1c3ddb1d708abd4364665d4591941c5af7797165a43cca34a3e0cf8cb3
Malicious
autF43A.tmp.tok
Malicious
Overlay_8d8bec38.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:2057
ID:0002
ID:2057
ID:0003
ID:2057
ID:0004
ID:2057
ID:0005
ID:2057
ID:0006
ID:2057
ID:0007
ID:2057
ID:0008
ID:2057
ID:0009
ID:2057
RT_MENU
ID:00A6
ID:2057
RT_STRING
ID:0007
ID:2057
ID:0008
ID:2057
ID:0009
ID:2057
ID:000A
ID:2057
ID:000B
ID:2057
ID:000C
ID:2057
ID:0139
ID:2057
RT_RCDATA
ID:0000
OtherSounds
DisablePause_Info.mp3
DisablePause_scope.mp3
DisablePause_weapon.mp3
Pictures
AKM.png-preview.png
AUG.png-preview.png
DP28.png-preview.png
GROZA.png
GROZA.png-preview.png
M16A4.png
M16A4.png-preview.png
M249.png-preview.png
M416.png-preview.png
M762.png-preview.png
MICROUZI.png
MICROUZI.png-preview.png
MINI14.png
MINI14.png-preview.png
MK14.png-preview.png
none.png-preview.png
QBU.png-preview.png
QBZ.png-preview.png
RDS.png-preview.png
SCARL.png
SCARL.png-preview.png
SKS.png-preview.png
SLR.png-preview.png
TOMMYGUN.png
TOMMYGUN.png-preview.png
UMP9.png-preview.png
VECTOR.png
VECTOR.png-preview.png
VSS.png-preview.png
X2.png-preview.png
X3.png-preview.png
X4.png-preview.png
X6.png-preview.png
X8.png-preview.png
weapons
Groza.mp3
M16A4.mp3
MICROUZI.mp3
MINI14.mp3
SCARL.mp3
TOMMYGUN.mp3
VECTOR.mp3
RT_GROUP_CURSOR4
ID:0063
ID:2057
ID:00A2
ID:2057
ID:00A4
ID:2057
ID:00A9
ID:2057
RT_VERSION
ID:0001
ID:2057
RT_MANIFEST
ID:0001
ID:2057
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 2secondary ignored: 4
bin 3img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:autoit
Shape pe:exe>pe:autoit
malicious 2 nodes
Path pe:exe>pe:rsrc>pe:autoit
Shape pe:exe>pe:rsrc>pe:autoit
3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_8d8bec38.bin (66264 bytes)
Info
PDB Path: ????
An error has occurred. This application may no longer respond until reloaded. Reload 🗙