Malicious
Disk Image
MD5: f8399cff4b78969dc3ec2bb55d59f3c8
Size: 23.8 MB
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Disk image
Size
23.8 MB · 23,797,760 B
Hashes
MD5
f8399cff4b78969dc3ec2bb55d59f3c8
Sha1
a238fb860a500f70a67228b1b595ae5203160a61
Sha256
7505f68c6428914e3d2fc83a22440694370d3b55013485595f9863950256f7c4
Sha384
e951995994566293c9d88d192bfad46e5483ddbe8f10f8cb174d8d79850979aedebc23f87e8dc4abc72bc55ff9c176a6
Sha512
71db2104b855cc3c136cc5e64323b135ead971725ebedfe5f673d6f73e898ec2e14b311734013324266eacc817a6813c3d6b833fbf11d830b79097e15b746c1b
SSDeep
393216:LoJesJnkfB846yhT/evPMRL31CPwDvt3uFhCkcFe9Xbp8kY3ucN6OJVBlH:GefBUEBNuc8Cr
TLSH
3A37BE16B2588199D467907CC893865BE3B2BC25AB6183DF30A6B32D1F337D12B7E354
3 malicious · 712 files
ISOf8399cff4b78969dc3ec2bb55d59f3c8T1059.005
EXEAdobe Installer.exe
TXTLICENSE.txt
_PTHpython312._pth
DLLpython312.dll
DLLvcruntime140.dll
DLLvcruntime140_1.dll
BINlib
EXE_asyncio.pyd
EXE_bz2.pyd
EXE_ctypes.pyd
EXE_decimal.pyd
EXE_elementtree.pyd
EXE_hashlib.pyd
EXE_lzma.pyd
EXE_msi.pyd
EXE_multiprocessing.pyd
EXE_overlapped.pyd
EXE_queue.pyd
EXE_socket.pyd
EXE_sqlite3.pyd
EXE_ssl.pyd
EXE_uuid.pyd
EXE_wmi.pyd
EXE_zoneinfo.pyd
DATblind_engine.dat
DATcore.dat
DLLlibcrypto-3.dll
DLLlibffi-8.dll
DLLlibssl-3.dll
EXEpyexpat.pyd
CATpython.cat
DLLpython3.dll
ZIPpython312.zipT1059.005
PYCabc.pyc
PYCaifc.pyc
PYCantigravity.pyc
PYCargparse.pyc
PYCast.pyc
PYCbase64.pyc
PYCbdb.pyc
PYCbisect.pyc
PYCbz2.pyc
PYCcalendar.pyc
PYCcgi.pyc
PYCcgitb.pyc
PYCchunk.pyc
PYCcmd.pyc
PYCcode.pyc
PYCcodecs.pyc
PYCcodeop.pyc
PYCcolorsys.pyc
PYCcompileall.pyc
PYCconfigparser.pyc
PYCcontextlib.pyc
PYCcontextvars.pyc
PYCcopy.pyc
PYCcopyreg.pyc
PYCcProfile.pyc
PYCcrypt.pyc
PYCcsv.pyc
PYCdataclasses.pyc
PYCdatetime.pyc
PYCdecimal.pyc
PYCdifflib.pyc
PYCdis.pyc
PYCdoctest.pyc
PYCenum.pyc
PYCfilecmp.pyc
PYCfileinput.pyc
PYCfnmatch.pyc
PYCfractions.pyc
PYCftplib.pyc
PYCfunctools.pyc
PYCgenericpath.pyc
PYCgetopt.pyc
PYCgetpass.pyc
PYCgettext.pyc
PYCglob.pyc
PYCgraphlib.pyc
PYCgzip.pyc
PYChashlib.pyc
PYCheapq.pyc
PYChmac.pyc
PYCimaplib.pyc
PYCimghdr.pyc
PYCinspect.pyc
PYCio.pyc
PYCipaddress.pyc
PYCkeyword.pyc
PYClinecache.pyc
PYClocale.pyc
PYClzma.pyc
PYCmailbox.pyc
PYCmailcap.pyc
PYCmimetypes.pyc
PYCmodulefinder.pyc
PYCnetrc.pyc
PYCnntplib.pyc
PYCntpath.pyc
PYCnturl2path.pyc
PYCnumbers.pyc
PYCopcode.pyc
PYCoperator.pyc
PYCoptparse.pyc
PYCos.pyc
PYCpathlib.pyc
PYCpdb.pyc
PYCpickle.pyc
PYCpickletools.pyc
PYCpipes.pyc
PYCpkgutil.pyc
PYCplatform.pyc
PYCplistlib.pyc
PYCpoplib.pyc
PYCposixpath.pyc
PYCpprint.pyc
PYCprofile.pyc
PYCpstats.pyc
PYCpty.pyc
PYCpyclbr.pyc
PYCpydoc.pyc
PYCpy_compile.pyc
PYCqueue.pyc
PYCquopri.pyc
PYCrandom.pyc
PYCreprlib.pyc
PYCrlcompleter.pyc
PYCrunpy.pyc
PYCsched.pyc
PYCsecrets.pyc
PYCselectors.pyc
PYCshelve.pyc
PYCshlex.pyc
PYCshutil.pyc
PYCsignal.pyc
PYCsite.pyc
PYCsmtplib.pyc
PYCsndhdr.pyc
PYCsocket.pyc
PYCsocketserver.pyc
PYCsre_compile.pyc
PYCsre_constants.pyc
PYCsre_parse.pyc
PYCssl.pyc
PYCstat.pyc
PYCstatistics.pyc
PYCstring.pyc
PYCstringprep.pyc
PYCstruct.pyc
PYCsubprocess.pyc
PYCsunau.pyc
PYCsymtable.pyc
PYCsysconfig.pyc
PYCtabnanny.pyc
PYCtarfile.pyc
PYCtelnetlib.pyc
PYCtempfile.pyc
PYCtextwrap.pyc
PYCthis.pyc
PYCthreading.pyc
PYCtimeit.pyc
PYCtoken.pyc
PYCtokenize.pyc
PYCtrace.pyc
PYCtraceback.pyc
PYCtracemalloc.pyc
PYCtty.pyc
PYCtypes.pyc
PYCtyping.pyc
PYCuu.pyc
PYCuuid.pyc
PYCwarnings.pyc
PYCwave.pyc
PYCweakref.pyc
PYCwebbrowser.pyc
PYCxdrlib.pyc
PYCzipapp.pyc
PYCzipimport.pyc
PYC_aix_support.pyc
PYC_collections_abc.pyc
PYC_compat_pickle.pyc
PYC_compression.pyc
PYC_markupbase.pyc
PYC_osx_support.pyc
PYC_pydatetime.pyc
PYC_pydecimal.pyc
PYC_pyio.pyc
PYC_pylong.pyc
PYC_py_abc.pyc
PYC_sitebuiltins.pyc
PYC_strptime.pyc
PYC_threading_local.pyc
PYC_weakrefset.pyc
PYC__future__.pyc
PYC__hello__.pyc
BINasyncio
BINcollections
BINconcurrent
BINctypes
BINcurses
BINdbm
BINemail
BINencodings
BINhtml
BINhttp
BINimportlib
BINjson
BINlib2to3
BINlogging
BINmsilib
BINmultiprocessing
BINpydoc_data
VBStopics.pycT1059.005
CSS_pydoc.css
PYC__init__.pyc
BINre
BINsite-packages
BINsqlite3
BINtomllib
BINunittest
BINurllib
BINwsgiref
BINxml
BINxmlrpc
BINzipfile
BINzoneinfo
BIN__phello__
EXEselect.pyd
PYCsitecustomize.pyc
DLLsqlite3.dll
EXEunicodedata.pyd
EXEwinsound.pyd
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 10
STICH kept: 3secondary ignored: 7
bin
6img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
img:disk>arc:zip>scr:vbs~T1059.005
Shape
img:disk>arc:zip>scr:vbs
technique3 nodes
Path
img:disk>arc:zip>html
Shape
img:disk>arc:zip>html
3 nodes
| Name | Value |
|---|---|
| ISO | DiskImage extraction mode: DiscUtils (ISO) |
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential