Suspicious
Suspect

fc3387fe006ae2579cde7b5aa3c739f2

MS Office Document
MD5: fc3387fe006ae2579cde7b5aa3c739f2
Size: 3.35 MB
application/vnd.ms-office

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 fc3387fe006ae2579cde7b5aa3c739f2
Sha1 ab35ee8e16d3faea5788b87c6b5b6919a65d328a
Sha256 91cf205a9dcebefc3dbcf0813908c2aa245f8225734dcc87d9e08224f5d4ec5d
Sha384 6a359b54f77f470c67f01eb4a5a73d069f9768661cf8552303c19630dd1d99a9adb5b242e6631165c79646f628d34e23
Sha512 c90b17f2287e2ccc04538b245c741ea654d6cd997635253129ca2dbf4fff1c36cd797fa0b596ac2500cec01adbbe1d9abbae5170a19728d1bd6a4c2d8d015b9d
SSDeep 98304:PBkFzdzZJe6Ueev0ShdIu8t8oaWLb+VCbiLDHs7WZkLneHr0Nu:PBqu10STImVwNgbULor4
TLSH 46F5238176940176E56B0635CA25B5A06B36FC101FF08A1E335AF37C6E7F390E936B62
Root Entry
䡀䆒䑲
䡀䌏䈯
[Authenticode]_5350ca9c.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.idata
.reloc
.symtab
䡀㲞䈝䗻
䡀䈖䌧䠤
䡀䌋䄱䜵
䡀䌍䏤䊲
䆒䑲䌾䒦䠱
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䈛䌪䗶䜵
䡀䋌䆨㫮䛲
䡀䒌䗱䒵䠯
䡀䓞䕪䇤䠨
䡀䕙䓲䕨䜷
䡀䈛㵪䆲䗤䕲
䡀䈝䗻䗜䏼䠨
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀䓊㼳䄨䆵䠫
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䄛䌧㫲䗸䒷䠱
䡀䒌䗱䒵㮯䈹䗱
䡀䕌䄨䈷䒏䇯䕨
䡀䖖㯬䏬㱨䖤䠫
䡀䘌䗶䐲䆊䌷䑲
䡀䙎䑨㶷䓤䌳䊱
[Authenticode]_d4921b5d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
䡀䄕䑸䋦䒌䇱䗬䒬䠱
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䡀䒌䗱䒵㬯䑲䌧䌷䑲
[Authenticode]_75bb7eca.p7b
InstallerCA_x64.dll
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
Overlay_abc8ad68.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
ID:1033
䌋䄱䜵䀾䛬㲞㫿䓰㷿䚨
䌋䄱䜵䀾䛬㲞㫿䓰㾿䠳
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䌋䄱䜵䀾䛬㲞㲿䒦㲿䉱䠲
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䌋䄱䜵䀾䛬㲞㫿䓰㫿䑤䈱䠵
䌋䄱䜵䀾䛬㲞㫿䓰㫿䑤䈱䠵-preview.png
䌋䄱䜵䀾䛬㲞㲿䒦㮿䆻䄯䠰
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
DigitalSignature
SummaryInformation
MsiDigitalSignatureEx
[Authenticode]_dd3c9d67.p7b
[Authenticode]_9234c590.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
CustomAction.config
[Authenticode]_f6e51a24.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Microsoft.Deployment.WindowsInstaller.Errors.resources
STICH beta

No STICH Path has been generated for this analysis yet.

7 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 6img 1
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Root Entry
䡀䆒䑲
䡀䌏䈯
[Authenticode]_5350ca9c.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.idata
.reloc
.symtab
䡀㲞䈝䗻
䡀䈖䌧䠤
䡀䌋䄱䜵
䡀䌍䏤䊲
䆒䑲䌾䒦䠱
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䈛䌪䗶䜵
䡀䋌䆨㫮䛲
䡀䒌䗱䒵䠯
䡀䓞䕪䇤䠨
䡀䕙䓲䕨䜷
䡀䈛㵪䆲䗤䕲
䡀䈝䗻䗜䏼䠨
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀䓊㼳䄨䆵䠫
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䄛䌧㫲䗸䒷䠱
䡀䒌䗱䒵㮯䈹䗱
䡀䕌䄨䈷䒏䇯䕨
䡀䖖㯬䏬㱨䖤䠫
䡀䘌䗶䐲䆊䌷䑲
䡀䙎䑨㶷䓤䌳䊱
[Authenticode]_d4921b5d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
䡀䄕䑸䋦䒌䇱䗬䒬䠱
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䡀䒌䗱䒵㬯䑲䌧䌷䑲
[Authenticode]_75bb7eca.p7b
InstallerCA_x64.dll
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
Overlay_abc8ad68.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
ID:1033
䌋䄱䜵䀾䛬㲞㫿䓰㷿䚨
䌋䄱䜵䀾䛬㲞㫿䓰㾿䠳
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䌋䄱䜵䀾䛬㲞㲿䒦㲿䉱䠲
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䌋䄱䜵䀾䛬㲞㫿䓰㫿䑤䈱䠵
䌋䄱䜵䀾䛬㲞㫿䓰㫿䑤䈱䠵-preview.png
䌋䄱䜵䀾䛬㲞㲿䒦㮿䆻䄯䠰
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
DigitalSignature
SummaryInformation
MsiDigitalSignatureEx
[Authenticode]_dd3c9d67.p7b
[Authenticode]_9234c590.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
CustomAction.config
[Authenticode]_f6e51a24.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Microsoft.Deployment.WindowsInstaller.Errors.resources
No malware configuration was found at this point.
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
fc3387fe006ae2579cde7b5aa3c739f2 › superopsSetupExeFile
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙