Malicious
Malicious

fcf05997f62ff7af03575abd10378c1f

Share on LinkedIn
Print
ZIP Archive
MD5: fcf05997f62ff7af03575abd10378c1f
Size: 19.09 MB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 fcf05997f62ff7af03575abd10378c1f
Sha1 6fbdd3cc92ce6c82234235db6bb2d8336bbbc899
Sha256 ff760476038ffcc82c2bf2cb3addd9b86b3f2c7a84ab3baffb7dd370476b348f
Sha384 c62c17d791557a2d1c42898e1ab1f79540eda05b3a1c1989e20bf25d29314f6345a9ff64ec287069775394526ff898db
Sha512 f277e65fa1f567f0dcff36808fc61c4b578dd60c669c2739d783ab88408e488588de63467f8337caebc118bfcd9c11fdbb69bffa837484b0f9d9b9d6d504e6ab
SSDeep 393216:fvoJYBm4PaJBjPvwL4835pf/9vV0wveZBYUnM8IFbUMM4WHLLT:fvoJm5EtgL445ptvV0wwznL+hMT
TLSH 541723BCB4B5B96AF5D4433BC7852CB6DB2CA500D7993D9F8E2041927DC320E5F6A821
browser
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
TYPELIB
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
[Authenticode]_488937e1.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_904e22f6.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_e87b953d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_a25954c6.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_450983df.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_500d09ed.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_fc9aa548.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_64e29d57.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_06d320e6.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_78374b25.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_bb8ef5bf.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_dd2655c4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_4421d511.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_4d55df76.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_619b8dea.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_b51ba3b5.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_c688f0df.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_fe5b36cc.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_736f2d9a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_b5bcfa7b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
[Authenticode]_d3069d88.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:1033
application.ini
[Authenticode]_38e2371a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
defaultagent.ini
defaultagent_localized.ini
dependentlibs.list
features
floorp-actions@floorp.ablaze.one.xpi
API
floorpActions.js
floorpActions.json
background.js
manifest.json
floorp-system@floorp.ablaze.one.xpi
API
BrowserInfo.js
BrowserInfo.json
IOFile.js
IOFile.json
aboutConfigPrefs.js
aboutConfigPrefs.json
browserL10n.js
browserL10n.json
decompressZip.js
decompressZip.json
downloadFile.js
downloadFile.json
sidebar.js
sidebar.json
download-notification.js
gesturefy
background.js
gesturefy.js
icons
failed.png
failed.png-preview.png
floorp.png
floorp.png-preview.png
link-48-last.png
link-48-last.png-preview.png
manifest.json
ua_data.js
update.js
webcompat
bug-1004-youtube-com.js
bug-894-twitter-com.css
webcompat_inject.js
webcompat_useragent.js
formautofill@mozilla.org.xpi
chrome.manifest
ar
locale
ar
formautofill.properties
background.js
chrome
content
autofillEditForms.js
customElements.js
editAddress.xhtml
editCreditCard.xhtml
editDialog.js
formautofill.css
formfill-anchor.svg
icon-address-save.svg
icon-address-update.svg
icon-credit-card-generic.svg
icon-credit-card.svg
manageAddresses.xhtml
manageCreditCards.xhtml
manageDialog.css
manageDialog.js
skin
autocomplete-item-shared.css
autocomplete-item.css
editAddress.css
editCreditCard.css
editDialog-shared.css
editDialog.css
third-party
cc-logo-amex.png
cc-logo-amex.png-preview.png
cc-logo-amex@2x.png
cc-logo-amex@2x.png-preview.png
cc-logo-cartebancaire.png
cc-logo-cartebancaire.png-preview.png
cc-logo-cartebancaire@2x.png
cc-logo-cartebancaire@2x.png-preview.png
cc-logo-diners.svg
cc-logo-diners.svg-preview.jpg
cc-logo-discover.png
cc-logo-discover.png-preview.png
cc-logo-discover@2x.png
cc-logo-discover@2x.png-preview.png
cc-logo-jcb.svg
cc-logo-jcb.svg-preview.jpg
cc-logo-mastercard.svg
cc-logo-mastercard.svg-preview.jpg
cc-logo-mir.svg
cc-logo-mir.svg-preview.jpg
cc-logo-unionpay.svg
cc-logo-unionpay.svg-preview.jpg
cc-logo-visa.svg
cc-logo-visa.svg-preview.jpg
cs
locale
cs
formautofill.properties
da
locale
da
formautofill.properties
de
locale
de
formautofill.properties
el
locale
el
formautofill.properties
en-GB
locale
en-GB
formautofill.properties
en-US
locale
en-US
formautofill.properties
es-ES
locale
es-ES
formautofill.properties
fr
locale
fr
formautofill.properties
hu
locale
hu
formautofill.properties
id
locale
id
formautofill.properties
it
locale
it
formautofill.properties
ja
locale
ja
formautofill.properties
ko
locale
ko
formautofill.properties
lt
locale
lt
formautofill.properties
manifest.json
nl
locale
nl
formautofill.properties
nn-NO
locale
nn-NO
formautofill.properties
pl
locale
pl
formautofill.properties
pt-BR
locale
pt-BR
formautofill.properties
pt-PT
locale
pt-PT
formautofill.properties
ru
locale
ru
formautofill.properties
schema.json
sv-SE
locale
sv-SE
formautofill.properties
th
locale
th
formautofill.properties
tr
locale
tr
formautofill.properties
uk
locale
uk
formautofill.properties
vi
locale
vi
formautofill.properties
zh-CN
locale
zh-CN
formautofill.properties
zh-TW
locale
zh-TW
formautofill.properties
formautofill@mozilla.org.xpi
0x0000FDB1.svg
0x0000FDB1.svg-preview.jpg
0x0001018B.svg
0x0001018B.svg-preview.jpg
0x00010565.svg
0x00010565.svg-preview.jpg
0x00010941.svg
0x00010941.svg-preview.jpg
0x00010C24.svg
0x00010C24.svg-preview.jpg
official-site-ua@floorp.ablaze.one.xpi
APIs
BrowserInfo.js
BrowserInfo.json
background.js
manifest.json
paxmod@numirias.xpi
background.html
background.js
browser.css
iconcolor.js
img
icon.png-preview.png
manifest.json
missing_api.html
options
options.css
options.html
options.js
paxmod-api-experiment
schema.json
stylesheet-api-experiment
schema.json
updateAPIs
aboutConfigPrefs.js
aboutConfigPrefs.json
w3color.js
pictureinpicture@mozilla.org.xpi
data
picture_in_picture_overrides.js
experiment-apis
aboutConfigPipPrefs.js
aboutConfigPipPrefs.json
pictureInPicture.js
pictureInPicture.json
lib
picture_in_picture_overrides.js
manifest.json
video-wrappers
airmozilla.js
dailymotion.js
disneyplus.js
hbomax.js
hotstar.js
mock-wrapper.js
netflix.js
nytimes.js
primeVideo.js
radiocanada.js
sonyliv.js
tubilive.js
twitch.js
videojsWrapper.js
washingtonpost.js
youtube.js
screenshots@mozilla.org.xpi
assertIsBlankDocument.js
assertIsTrusted.js
background
analytics.js
communication.js
deviceInfo.js
selectorLoader.js
senderror.js
startBackground.js
takeshot.js
blank.html
blobConverters.js
build
inlineSelectionCss.js
selection.js
thumbnailGenerator.js
catcher.js
clipboard.js
domainFromUrl.js
experiments
screenshots
schema.json
manifest.json
moz.build
randomString.js
selector
callBackground.js
documentMetadata.js
shooter.js
uicontrol.js
sitehelper.js
webcompat-reporter@mozilla.org.xpi
chrome.manifest
ar
locale
ar
webcompat.properties
background.js
cs
locale
cs
webcompat.properties
da
locale
da
webcompat.properties
de
locale
de
webcompat.properties
el
locale
el
webcompat.properties
en-GB
locale
en-GB
webcompat.properties
es-ES
locale
es-ES
webcompat.properties
experimentalAPIs
aboutConfigPrefs.js
aboutConfigPrefs.json
actors
tabExtrasActor.jsm
browserInfo.js
browserInfo.json
helpMenu.js
helpMenu.json
l10n.json
tabExtras.js
tabExtras.json
fr
locale
fr
webcompat.properties
hu
locale
hu
webcompat.properties
icons
lightbulb.svg
id
locale
id
webcompat.properties
it
locale
it
webcompat.properties
ja
locale
ja
webcompat.properties
ko
locale
ko
webcompat.properties
lt
locale
lt
webcompat.properties
manifest.json
nl
locale
nl
webcompat.properties
nn-NO
locale
nn-NO
webcompat.properties
pl
locale
pl
webcompat.properties
pt-BR
locale
pt-BR
webcompat.properties
pt-PT
locale
pt-PT
webcompat.properties
ru
locale
ru
webcompat.properties
sv-SE
locale
sv-SE
webcompat.properties
th
locale
th
webcompat.properties
tr
locale
tr
webcompat.properties
uk
locale
uk
webcompat.properties
vi
locale
vi
webcompat.properties
zh-CN
locale
zh-CN
webcompat.properties
zh-TW
locale
zh-TW
webcompat.properties
webcompat-reporter@mozilla.org.xpi
0x000074FA.svg
0x000074FA.svg-preview.jpg
webcompat@mozilla.org.xpi
about-compat
AboutCompat.sys.mjs
aboutCompat.css
aboutCompat.html
aboutCompat.js
aboutPage.js
aboutPage.json
aboutPageProcessScript.js
data
injections.js
ua_overrides.js
experiment-apis
aboutConfigPrefs.js
aboutConfigPrefs.json
aboutConfigPrefsChild.js
appConstants.js
appConstants.json
matchPatterns.js
matchPatterns.json
systemManufacturer.js
systemManufacturer.json
trackingProtection.js
trackingProtection.json
injections
css
bug0000000-testbed-css-injection.css
bug1575000-apply.lloydsbank.co.uk-radio-buttons-fix.css
bug1610344-directv.com.co-hide-unsupported-message.css
bug1644830-missingmail.usps.com-checkboxes-not-visible.css
bug1651917-teletrader.com.body-transform-origin.css
bug1653075-livescience.com-scrollbar-width.css
bug1654877-preev.com-moz-appearance-fix.css
bug1654907-reactine.ca-hide-unsupported.css
bug1694470-myvidster.com-content-not-shown.css
bug1707795-office365-sheets-overscroll-disable.css
bug1712833-buskocchi.desuca.co.jp-fix-map-height.css
bug1741234-patient.alphalabs.ca-height-fix.css
bug1765947-veniceincoming.com-left-fix.css
bug1770962-coldwellbankerhomes.com-image-height.css
bug1774490-rainews.it-gallery-fix.css
bug1784141-aveeno.com-acuvue.com-unsupported.css
bug1784199-entrata-platform-unsupported.css
bug1819678-nppes.cms.hhs.gov-unsupported-banner.css
bug1829949-tomshardware.com-scrollbar-width.css
bug1830747-babbel.com-page-height.css
bug1830752-afisha.ru-slider-pointer-events.css
bug1830761-91mobiles.com-content-height.css
bug1830796-copyleaks.com-hide-unsupported.css
bug1830810-interceramic.com-hide-unsupported.css
bug1830813-page.onstove.com-hide-unsupported.css
bug1836103-autostar-novoross.ru-make-map-taller.css
bug1836105-cnn.com-fix-blank-pages-when-printing.css
bug1848711-vio.com-page-height.css
bug1848713-cleanrider.com-slider.css
bug1848716-elal.com-unsupported-banner.css
bug1848849-theaa.com-printing-mode-fix.css
bug1849019-axa-assistance.pl-datepicker-fix.css
bug1849388-kucharkaprodceru.cz-scroll-fix.css
bug1868345-tvmovie.de-scroll-fix.css
js
bug0000000-testbed-js-injection.js
bug1448747-fastclick-shim.js
bug1452707-window.controllers-shim-ib.absa.co.za.js
bug1457335-histography.io-ua-change.js
bug1472075-bankofamerica.com-ua-change.js
bug1579159-m.tailieu.vn-pdfjs-worker-disable.js
bug1631811-datastudio.google.com-indexedDB.js
bug1722955-frontgate.com-ua-override.js
bug1724868-news.yahoo.co.jp-ua-override.js
bug1739489-draftjs-beforeinput.js
bug1769762-tiktok.com-plugins-shim.js
bug1774005-installtrigger-shim.js
bug1799968-www.samsung.com-appVersion-linux-fix.js
bug1799980-healow.com-infinite-loop-fix.js
bug1818818-fastclick-legacy-shim.js
bug1819450-cmbchina.com-ua-change.js
bug1819476-axisbank.com-webkitSpeechRecognition-shim.js
bug1819678-free4talk.com-window-chrome-shim.js
bug1830776-blueshieldca.com-unsupported.js
bug1831007-nintendo-window-OnetrustActiveGroups.js
bug1836157-thai-masszazs-niceScroll-disable.js
bug1842437-www.youtube.com-performance-now-precision.js
bug1849058-nicochannel.jp-picture-in-picture-shim.js
bug1855014-eksiseyler.com.js
bug1855071-www.meteoam.it.js
bug1859617-installtrigger-removal-shim.js
bug1864564-esri-transfrom-names-shim.js
lib
about_compat_broker.js
custom_functions.js
injections.js
intervention_helpers.js
messaging_helper.js
module_shim.js
requestStorageAccess_helper.js
shim_messaging_helper.js
ua_helpers.js
ua_overrides.js
manifest.json
shims
addthis-angular.js
adform.js
adnexus-ast.js
adnexus-prebid.js
adsafeprotected-ima.js
apstag.js
blogger.js
bloggerAccount.js
bmauth.js
branch.js
chartbeat.js
crave-ca.js
criteo.js
cxense.js
doubleverify.js
eluminate.js
empty-script.js
empty-shim.txt
everest.js
facebook-sdk.js
facebook.svg
fastclick.js
firebase.js
google-ads.js
google-analytics-and-tag-manager.js
google-analytics-ecommerce-plugin.js
google-analytics-legacy.js
google-ima.js
google-page-ad.js
google-publisher-tags.js
google-safeframe.html
history.js
iaspet.js
instagram.js
live-test-shim.js
maxmind-geoip.js
microsoftLogin.js
microsoftVirtualAssistant.js
mochitest-shim-1.js
mochitest-shim-2.js
mochitest-shim-3.js
nielsen.js
optimizely.js
private-browsing-web-api-fixes.js
rambler-authenticator.js
rich-relevance.js
salesforce.js
spotify-embed.js
tracking-pixel.png
tracking-pixel.png-preview.png
tsn-ca.js
vast2.xml
vast3.xml
vidible.js
webtrends.js
webcompat@mozilla.org.xpi
0x0004D3A8.svg
0x0004D3A8.svg-preview.jpg
0x0005E68D.svg
0x0005E68D.svg-preview.jpg
webpanel-ua@floorp.ablaze.one.xpi
APIs
webRequestExt.js
webRequestExt.json
background.js
link-48.png
link-48.png-preview.png
manifest.json
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.freestd
.tls
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:1033-preview.png
ID:0003
ID:1033
ID:1033-preview.png
ID:0004
ID:1033
ID:1033-preview.png
ID:0005
ID:1033
ID:1033-preview.png
ID:0006
ID:1033
ID:1033-preview.png
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0011
ID:1033
ID:1033-preview.png
ID:0012
ID:1033
ID:1033-preview.png
ID:0013
ID:1033
ID:1033-preview.png
ID:0014
ID:1033
ID:1033-preview.png
ID:0015
ID:1033
ID:1033-preview.png
ID:0016
ID:1033
ID:0017
ID:1033
ID:0018
ID:1033
ID:0019
ID:1033
RT_STRING
ID:0007
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:7F00
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
floorp.VisualElementsManifest.xml
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
install.log
installation_telemetry.json
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
locale.ini
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
[Authenticode]_14172093.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
platform.ini
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
precomplete
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
private_browsing.VisualElementsManifest.xml
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
removed-files
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
[Authenticode]_b7e1f48b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
update-settings.ini
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.voltbl
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
RT_DIALOG
ID:0065
ID:1033
RT_STRING
ID:003F
ID:1033
RT_GROUP_CURSOR4
ID:03EB
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
ID:0011
ID:1033
updater.ini
[Authenticode]_308ff424.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
VisualElements
PrivateBrowsing_150.png
PrivateBrowsing_150.png.exif
PrivateBrowsing_150.png-preview.png
VisualElements_150.png
VisualElements_150.png-preview.png
VisualElements_70.png
VisualElements_70.png-preview.png
byondapi
byondapi.h
byondapi.lib
byondapi_cpp_wrappers.cpp
byondapi_cpp_wrappers.h
sample
byondapi_sample.vcxproj
byondapi_sample.vcxproj.filters
byondapi_sample.vcxproj.user
gmp-clearkey
0.1
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
manifest.json
Overlay_bdbdfea8.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.gfids
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
RT_RCDATA
ID:0000
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.00cfg
.tls
.rsrc
.reloc
Resources
RT_DIALOG
ID:0065
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:03E8
ID:1033
ID:03E9
ID:1033
RT_VERSION
ID:0001
ID:1033
[Authenticode]_8a74c34a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.gfids
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
[Authenticode]_fcfc5664.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
x64
FontSizer
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
FontSizer.FrmFontSizer.resources
$this.Icon
FontSizer.Properties.Resources.resources
AlternateTools2k16
[NBF]root.Data
FontSizer_Icon
[NBF]root.Data
[NBF]root.Data-preview.png
img_confirmation_icon
[NBF]root.Data
[NBF]root.Data-preview.png
img_error_icon
[NBF]root.Data
[NBF]root.Data-preview.png
img_information_icon
[NBF]root.Data
[NBF]root.Data-preview.png
img_warning_icon
[NBF]root.Data
[NBF]root.Data-preview.png
FontSizer.exe.config
FontSizer_Languages.ini
FontSizer_Language_Arabic.ini
FontSizer_Language_Danish.ini
FontSizer_Language_English.ini
FontSizer_Language_French.ini
FontSizer_Language_German.ini
FontSizer_Language_Greek.ini
FontSizer_Language_Hungarian.ini
FontSizer_Language_Japanese.ini
FontSizer_Language_Russian.ini
FontSizer_Language_Spanish.ini
FontSizer_Language_Turkish.ini
FontSizer_License.txt
FontSizer_Readme.txt
SavePath.ini
Source
FontSizer
app.manifest
ClassFontSettings.cs
ClassFormColors.cs
ClassInit.cs
ClassLogFontStruct.cs
ClassOptions.cs
ClassRegistry.cs
ClassTable.cs
FontSizer.csproj
FontSizer.csproj.user
FontSizer.ico
FrmEdit.cs
FrmEdit.Designer.cs
FrmFontSizer.cs
FrmFontSizer.Designer.cs
FrmFontSizer.resx
FrmHelp.cs
FrmHelp.Designer.cs
FrmHelp.resx
FrmInfo.cs
FrmInfo.Designer.cs
FrmInfo.resx
FrmLanguage.cs
FrmLanguage.Designer.cs
FrmMessageBox.cs
FrmMessageBox.Designer.cs
FrmMessageBox.resx
FrmOptions.cs
FrmOptions.Designer.cs
FrmOptions.resx
FrmPreview.cs
FrmPreview.Designer.cs
FrmPreview.resx
Program.cs
Properties
AssemblyInfo.cs
Resources.Designer.cs
Resources.resx
Settings.Designer.cs
Settings.settings
Resources
AlternateTools2k16.bmp
img_confirmation_icon.png
img_confirmation_icon.png-preview.png
img_error_icon.png
img_error_icon.png-preview.png
img_information_icon.png
img_information_icon.png-preview.png
img_warning_icon.png
img_warning_icon.png-preview.png
FontSizer.sln
Images
FontSizer.xcf
FontSizer_InstallLarge.bmp
FontSizer_InstallSmall.bmp
FontSizer_Install_Icon.ico
MessageBoxIcons.xcf
Install
FontSizer.iss
Scripts
FontSizer_Languages.ini
FontSizer_License_Arabic.txt
FontSizer_License_Danish.txt
FontSizer_License_French.txt
FontSizer_License_German.txt
FontSizer_License_Greek.txt
FontSizer_License_Hungarian.txt
FontSizer_License_Japanese.txt
FontSizer_License_Russian.txt
FontSizer_License_Spanish.txt
FontSizer_License_Turkish.txt
UnInstCleanup_Arabic.ini
UnInstCleanup_Danish.ini
UnInstCleanup_English.ini
UnInstCleanup_French.ini
UnInstCleanup_German.ini
UnInstCleanup_Greek.ini
UnInstCleanup_Hungarian.ini
UnInstCleanup_Japanese.ini
UnInstCleanup_Russian.ini
UnInstCleanup_Spanish.ini
UnInstCleanup_Turkish.ini
unins000.dat
Overlay_17475b42.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.rsrc
Resources
RT_CURSOR
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
RT_BITMAP
ID:0000
ID:0
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
RT_STRING
ID:0FE9
ID:0
ID:0FEA
ID:0
ID:0FEB
ID:0
ID:0FEC
ID:0
ID:0FED
ID:0
ID:0FEE
ID:0
ID:0FEF
ID:0
ID:0FF0
ID:0
ID:0FF1
ID:0
ID:0FF2
ID:0
ID:0FF3
ID:0
ID:0FF4
ID:0
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:0
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
Resources
RT_MANIFEST
ID:0001
ID:1033
RT_GROUP_CURSOR2
ID:7FF9
ID:1033
ID:7FFA
ID:1033
ID:7FFB
ID:1033
ID:7FFC
ID:1033
ID:7FFD
ID:1033
ID:7FFE
ID:1033
ID:7FFF
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
UnInstCleanup.FrmInfo.resources
$this.Icon
[NBF]root.IconData
UnInstCleanup.FrmMessageBox.resources
UnInstCleanup.Properties.Resources.resources
UnInstCleanupDlg
[NBF]root.Data
[NBF]root.Data-preview.png
img_confirmation_icon
[NBF]root.Data
img_error_icon
[NBF]root.Data
img_information_icon
[NBF]root.Data
img_warning_icon
[NBF]root.Data
TwemojiMozilla.ttf
[Authenticode]_8e3e2e0c.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
21 / 21
Path arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious 6 nodes
Path arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious 6 nodes
An error has occurred. This application may no longer respond until reloaded. Reload 🗙