a3a264617e3ef583f7a8e9747ad08da7c5e831ee25eb597543512ae32ddf628c

Sharing

Copy URL Twitter E-mail

General

Target
Crazy Error V2 Installer (1).exe
Size 36.6MB
Sample260723-2vv62acp51
SHA256 a3a264617e3ef583f7a8e9747ad08da7c5e831ee25eb597543512ae32ddf628c
MD5 88b35804fb768542a8020f370ee2bbf5
SHA1 5410e4d9fd812e6dd2470bff060e88c65f5e8c4a
SHA512 0a95f3e6154b8421d83b1e09f39edc07ebacb651dcf07ce64418c72ef60fe0d77d5570daea959818059ce66f1783f304dc2f8f56b2a2fbf69d8e0745fa1cca75
SSDEEP 786432:hTkzYE5THTYjifPkJhvxrbWEPV9ILkbF/4t7Zh9fUUMgOqvO+kT6B:hTkcQTzYNbvRWEt9PbQh9fUFqW+ko
TLSH
T1DF87335A3FED5904E2B40339A27386FA00DDB71347625F8AD33512684DB37AE9A1E50F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Targets

- Target
  Crazy Error V2 Installer (1).exe
- Size 36.6MB
- SHA256 a3a264617e3ef583f7a8e9747ad08da7c5e831ee25eb597543512ae32ddf628c
- MD5 88b35804fb768542a8020f370ee2bbf5
- SHA1 5410e4d9fd812e6dd2470bff060e88c65f5e8c4a
- SHA512 0a95f3e6154b8421d83b1e09f39edc07ebacb651dcf07ce64418c72ef60fe0d77d5570daea959818059ce66f1783f304dc2f8f56b2a2fbf69d8e0745fa1cca75
- SSDEEP 786432:hTkzYE5THTYjifPkJhvxrbWEPV9ILkbF/4t7Zh9fUUMgOqvO+kT6B:hTkcQTzYNbvRWEt9PbQh9fUFqW+ko
- TLSH
  T1DF87335A3FED5904E2B40339A27386FA00DDB71347625F8AD33512684DB37AE9A1E50F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1
- Target
  lib/tk/demos/floor.tcl
- Size 77KB
- SHA256 7f16498694dad93ebaa974dce6cd3b19e47ba9827fe2f1d1957e8a0521bbb25c
- MD5 4e9b269536f724d51b730f28f99112d1
- SHA1 f37a910023ed172d737a16071d15f0c7f7166008
- SHA512 befdd31d716810ae29dad922ff4f0ed431cbf4efb0d878b92991fe990617d4ceb9cd76f7ac0c5f801a487aa61de7c4737b5902a3d51ac1794ed2474c3559dc5c
- SSDEEP 768:bA1APpAS+uxgBk/O/YwBWVhX7dWz5lBVTSZ8blAhOkyxO9:8qPX+u+pYwBWVB7dWzrSgAhOkyM9
- TLSH
  T1C0733C0CE39480AAE54247F71DBCD2278E67C35723E79738B056AD85DB00A16A4FEE71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  lib/tk/demos/goldberg.tcl
- Size 55KB
- SHA256 d79a5ec48b2e411ee9a9bebed5536583fcaaae43533a7d47d0f52caf6fd4f75d
- MD5 395a368f65dcf63ba1ac868a20bff71c
- SHA1 b63dbdcec938419ee72e8a0a0b9376d3bca4afe3
- SHA512 64ab15513227d38e5ea27d36414e3a695555525e40cc1e7f3be1abd1164a71d3496895fed511b39a4960ab336510ca9e236898093dce1140a86c6d5c6d79dfad
- SSDEEP 768:Y2zGGafFkfIfGMqKfY3wCTvKOj1+mcptngVym61qBj7ZToqIX4J+5bnaoRX:Y2Xafo4GrKfWvKm1+Jmn7nIfmoh
- TLSH
  T17C43314EE1814299B203D17B1475E15579AB93EB46CFCD18B02E9A98EF40708C2FE7F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3
- Target
  lib/tk/demos/hello
- Size 509B
- SHA256 9bf910b3e7ffcbb42d573c287803640708998b9103b41fa318a169257be9d048
- MD5 c345e2014709f3933e48dff086dbd381
- SHA1 ac1cc773c4e388b56175a2203473bff34f36dbc6
- SHA512 3f3ebace616657333a89c2456f4378bfd1b252b65f451c296e796e42a892f1862b64b633ba238ed7035937642594c3cd1439eea555e35b6b7560cb53af82c2d4
- TLSH
  T12CF00EC2A2C033F4853D993B33AEF1F03509CC2E22B5E410D4964045B6A4635C73F9C5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  lib/tk/demos/items.tcl
- Size 9KB
- SHA256 932f64797caca3d954c23480c76b1d1c6a0b4036cd9d065d96e2539b544f22cd
- MD5 cad24fb5c9aa9a84fcf3774aef3b7c64
- SHA1 0a0593c04a3c23332d5633ca1f25531e965c5ffe
- SHA512 6f479134dedca0e7e34349d9ce17c2887ef56517b7799f5311a3f9c421f1eff5fd1f00f33398b82927d9d2f8847efac55d637589990e5a09e0a2593a452e6e28
- SSDEEP 192:0O/DtvqEF9qFXdvyVxtT4zffvCfow/fx4vfMgfhd+ht2ZIKYCfO7gsXHKAHZbsYd:0wxvFFwFXdvs4LiB/pAhpWDKYCm7gsXV
- TLSH
  T1AE22322DF0D7327AE452E6233AA47004EF96C65393BEDF103189C118E75827E50F976A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5
- Target
  lib/tk/demos/ixset
- Size 7KB
- SHA256 e14af02675b9d31fa5cccdc18f2a816556c792ffb3e69d30280260e95f914172
- MD5 1af2c5e909078e8930e0edc087f84ea7
- SHA1 3c18a5a68de183bd150cff73b4fa94c72acae5c1
- SHA512 f97fb958a1fb181eed6649fcde117a19d18e02970275ccb0b231622e64405593d3351a8e8433bd804bdaf3ff02d2d4425fe9f3f4c3d3bcb28054b10dd5d4f6b5
- SSDEEP 192:DK/fALdwDD0FMe0N3RF8opw5oVUPPEtfg:guK/0D0N3n8o3K
- TLSH
  T1B6F186D182C21B59FBD90F37CA9672013B39828784E7F81DF05DE5B46F41E19909A7CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  lib/tk/demos/knightstour.tcl
- Size 8KB
- SHA256 27bad4e19058321b08be595079eef34fc7d2029adeae5922062297b19ebf098c
- MD5 4d35d0d3bd16fcbb0df50e3d6bf7f7a8
- SHA1 f7e8e77d0a8ee39d924b4ec675b885a4770b29c3
- SHA512 c71979d4c8e4b5cf87f1da883d00785d9565eb5fc07381951c4b3d431f4c1619c71bf45157ca217ac057f322736916405ce384c149a7a591a170b0a358588ff3
- SSDEEP 192:wp00XiQkeiQkD+IT+zyiQKKFLG+XYQctEfNCAeshdkM6qkxKMDORXx1QVwisPiyx:wa0FIT+0YZcOWqqADWxgD+jYa0E
- TLSH
  T1BE12560531952DA87486903B44F99651B923D0FBC18CDE1978EED1FE5FD2061C2EA7F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7
- Target
  lib/tk/demos/labelframe.tcl
- Size 1KB
- SHA256 a964cd6526509801cd0873a63fe23fafd6d959136fd046133f480af2c6359b24
- MD5 84c5ae01935052baf7be97e586ff9cd9
- SHA1 f605ae473d80a7c30d00fd596d247666fe10b9e7
- SHA512 539a92652fb6cbbf964b240382c42f6b0eb9e99de1465548359d4568cfdfeddc635a3a55c70862f7afd5c09a6efb032864581e1e715768437024cdf85d7fc04c
- TLSH
  T18C31436375A03A42E19754D4128A51206F30A2D5A39AFC8C786FDA7C87C0657CAFFBC5
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral8
- Target
  lib/tk/demos/menubu.tcl
- Size 4KB
- SHA256 a25464b3800072e03ba3a030eb3cb9ede592dc486d1cac8f27846df18a1e3f56
- MD5 46c45f72e523ab251d4840dea45e16d3
- SHA1 57e47db7d174cf525083718ba4faa7c5b0ccd46c
- SHA512 6fa3216870e31a41460cfb40a55ab04ebac9ebbaf1bc24d137b4bddd2a2fb3239480024eefe383c5675c38ba5438cde97a411f99aed996e98c0a6d9cf1a1c593
- SSDEEP 96:nAHOnya1iwyQJDScCJErDjRFgQV1fw5atJCU5GYGQZGtuw:nAHOn6QNgyrxFgAfw5Y5GjwGT
- TLSH
  T1AC913403599A7323C16261D64DCFA180FE79D150438FED98755ED1989BE80074BFBDC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral9
- Target
  lib/tk/demos/msgbox.tcl
- Size 1KB
- SHA256 aff7a31e5da170fd478bc45febce70b075329e8902e5efb58141d975d4f7f3e5
- MD5 f667eb06d00b4f9e229c3535db7fcdf7
- SHA1 fed544b8006dd76d2bfc29238a1c480e2e68dda6
- SHA512 2481c119ab36b559488bc0f1704d53f1b0862c7a6cf8ffbef242fd39aa12e74a54b089bb7668b94e919168112c83a4e12e4b412771693b9756fcc059fb67f0d5
- TLSH
  T1BA41F0D16AA07B5CC28540B77B7E3058BA288485D7E2BE28E08DD5B8C35405F899C3D7
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10
- Target
  lib/tk/demos/pendulum.tcl
- Size 7KB
- SHA256 88d23c1f0f8b2867b2894fc721553d9b2f0402c9dfb6824d27acdd8e13206835
- MD5 67efed0b5120537ac52c1591299eb35d
- SHA1 ecd9623e9c976519fa9e9de77e75ba8783c2fceb
- SHA512 0bfceca0b5bdef7098db030b0360053ab1444f05a28026d900e46aefc9543b52620b2a40fa011817565af53bc634c9aab9b3d02d5558fb39aabf0a03d73bd929
- SSDEEP 192:uGObOUJP+WzUebrz+gaGdfqVe+mufHj8MZO5VHee589y5BDu:7iB3Uebf9NqdC5CWBy
- TLSH
  T119F183476325032D2446D172341DE2C2AE39C46AA2D7D72CB4AEC1A88F5152B83EF7F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11
- Target
  lib/tk/demos/rmt
- Size 5KB
- SHA256 b1d563b779280299eed96610244125b0cc908c5c830ae1de2765c1b074de0478
- MD5 b91b4e8cc3fa480964cd84cb432b8351
- SHA1 ca4d12775376d7a33389e8e8967453ec775f0602
- SHA512 95a6ced3cfbee4f9d98de41a049f39ce44a8aec217f70a7a0e4a113ef4a35377bfa4bebf96faf6c9ccd4473a6ad65596acb4eaa27c1df066c3d924c82c9688cc
- SSDEEP 96:cec3+zp0A66cybXk07POdXOdndrvd7sdgdhd7d+oQqsQeoTHyfNRaiksRiIXaQ7L:3cOz7bzPOdXOdndTdgdgdhd7daqjeouD
- TLSH
  T1E6B1633BE5E72EF1660B143E569E329037ED43EB7BE8D581A895C600DB4801991F63C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  lib/tk/demos/search.tcl
- Size 4KB
- SHA256 7716ea5f9fcf0ff244012666654e92578d1679bf5dd762a439b9f9a5be21467f
- MD5 7924170dddefc4cf2f24b7e72243fe88
- SHA1 223f5467adc73cad40e29a1a468dd899a9b83284
- SHA512 6ae176340c8255d1d998d2e51f9de130e3a22857d7d1d8bf1ccd0a3bb64c9f610fdd3897c4f8a9442c870e858a413cbf8687deb508563c6f4427e7d483e37ad5
- SSDEEP 96:BOSxvcqBSVop5HTWW6dk6x3zqgben3FUCDx+TrdDGsYo8HAuCVpzJlO9:BO7qPXiZdAHdWY47G
- TLSH
  T111918457529C0732EAA200B1A2CF70907E19C2DDD765CA84E8EEDB347268D7B81F53D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13
- Target
  lib/tk/demos/square
- Size 1KB
- SHA256 da85f40a193c79f2efc803931aa763639c8fe182639b546253958f2c2d90fcbf
- MD5 73fa72665e40a9ec55222c7513a5c96a
- SHA1 f2b9124661583ee43793b79dcc1f985cb20abd41
- SHA512 efdbd45ea0f83f57080ab76a7ce48bf7c19a75aecbb87a74b47e06a1c98c55dfe2fa88ac4ab3353b68fd0a278596a6608dee081f3518f4c6d9d250e57e72cb4b
- TLSH
  T191215063708726E0094755BF3AC9C180AB6D90CFB2A9F1007839E04167A60B443F3AF2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  lib/tk/demos/style.tcl
- Size 6KB
- SHA256 41e80dd275b5a4e2c432a9991e82a1bb3ca028535ae5d187bb51dc36c0d0e660
- MD5 a160ffa0a65af1221979355bc70dce95
- SHA1 7bfe597113864f0b4670c4d84266310df00d7fe7
- SHA512 5ad380c89a086d9858ac7c1fd507bb24ea3832c3133fb9c06c77744eefde78ba727f54487ce299dd7337b3ad8960f34badf50d3289860d5909c1e97e3953a512
- SSDEEP 192:xOqzpm64/ErQcHu9LTfprN6WGSopWjXF/Cz3WO8Iaz1/ar1npTWD/uxM6ytcwag6:x1a/fIx
- TLSH
  T19CE1AD2F328C4E7FD6E1007322863B446D17C1EAE691FF6A65E6E068175603DC26FB80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15
- Target
  lib/tk/demos/tcolor
- Size 10KB
- SHA256 ac9ef647e540271eefdef438792ac673e0470ae63a35b51b0fbc963d0737a4ba
- MD5 97b924609dfb991a4b3140f5b412fe55
- SHA1 f37b753c3d0b1b9661ab79fc391de10e0dad3522
- SHA512 5ca46d5cdcd660b1cf16fe81b565a2baad6d63d8b31e3e6bb6a43cde96f44e0aa273dce3f746205ba4850a1550bd59c1337871cdef1ea77caf6b3ebbdffa0034
- SSDEEP 192:DcI9Tiu4iEpDCC9IZJGGpiUHF1RU8fIY6ahdmkZo0gI6neQJ+gPNiAORVLd1ZaK2:DcI9TiurEpW/JGGl1RPmahdrZo0k+gAm
- TLSH
  T16332A716C7C6465AF0D6843F584DE2686FBE5247D285CF4DB82EC078B70087980FEAD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  lib/tk/demos/textpeer.tcl
- Size 2KB
- SHA256 1b4f5c83a97cdd234d28784e109e0a4c3d73778a2e082599e23c239807513d0f
- MD5 a16b50b1a5591814fc705c79c667b299
- SHA1 c50271760859a938cbfee8c27c4377fb3164b1e2
- SHA512 bdadfb7e7cf160857d5f94aa3eda593527707ed236d53a0ca3869adc9b4a4223934a1feef4f7a76c6a4ad1491f4f038408c5fbc15f27102f5b69bf1a0d8a6f73
- TLSH
  T1AC413117524D5F21EB95C43378C063D53B20E26BD2A5EA4C69CDE0286BC1AB940FEFD1
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17
- Target
  lib/tk/demos/timer
- Size 1KB
- SHA256 5b3f35108dedc05037876be974bbfe18899509c203d5ba4a15e225fbe81d1a59
- MD5 ff4e73f84e446aef7f57f7a6cc4de96a
- SHA1 a0b695bf0ce4725a717b455c71b5132f0c3b990e
- SHA512 2452d543c638b5c88bf5f30e8bc94ce18dc2a89571f952d86b7b3d3c1688b3a870a611d71c6adeedb564eba1ad94f73aad878ef8fc387a0a214a35ea56df5c69
- TLSH
  T1F411074930612963ADC7845DF755E7304900818303D9D92E70FEA36F5E9E067807A785
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  lib/tk/demos/ttkbut.tcl
- Size 3KB
- SHA256 4606d54b5645f64e031635b7cb12ca0640312c3cb9a67f6e726ed90925d88c2e
- MD5 e4a33806f58577f1d7c52e495a9117dd
- SHA1 6cf5b9d66622f70e58d7278a3ecf2e960177a8c4
- SHA512 e1d8e6d4aafc9b68dd1687fda57b2efb865c1bcb918bb1ddee51f16e4dbcc7e8effbe814c75f1cd5129d3bccc8cf3a81eacc0ce2d0b0e6736c9f760fafb67678
- TLSH
  T188613467142423A5E3C1C0380A6F42A43B3096DCD3A2BD94B4DAD7BD439443398BF6B3
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19
- Target
  lib/tk/demos/ttkpane.tcl
- Size 4KB
- SHA256 95273e7b7fd4fd68bc0a45548f5a9375dea4f0af9c31f553bcd0ee63d2d32c66
- MD5 f19b83718b9c4f3bc970e424fc6075de
- SHA1 7f4ea7b69cfa77d89f2f2478d98a4ebd3b40b962
- SHA512 fb9356f7dcf6ce78b6b8d00ef044d24a3e0951f13f07f22373b1c9c6e866fcb145b302765c0f3377f99d7f6aa846f407ba9c4e0cce2428c08d31b345cb0dea9d
- SSDEEP 96:LOcTd5Y4hf31pY0vr0vHTURfK+kr5X/o9S5PJLMvujp+ZpKor:LOc55b/Ejr5P/LhK/
- TLSH
  T1B581A36607A4623ED1E248628B6F62307728C1A797D6AD38F4ACC54C5B0225B257C7E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral20
- Target
  lib/tk/demos/twind.tcl
- Size 10KB
- SHA256 8f2d28a8825796a5458c40c9a72f297d538c7a2a3d9af0563f81ba663ff7869b
- MD5 466132441ae8e1e6aa9085e5a00667a2
- SHA1 ff29d33339af8ae1b1c812fbfb8e387d3796ef67
- SHA512 eb021109df160310becd8326265f29a07067e96908b790355d537d1706b541e6f2f9134c147676859c4252468ebea75440e1cb47cd2db896eec4112b6c9b669e
- SSDEEP 192:pOpYtWToifHUe2loJ397+B+nrG5QCI4mP0r7fbdP7loph3AeOGsxpwhqx4:piYoL/B2ls0B+nrGGCI4XP7lwJO0Q4
- TLSH
  T16832651B635409E7B3E180331A5FA3007A12D2ABD2E5ED5839CAC258AB9113FC67F7C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21
- Target
  lib/tk/demos/unicodeout.tcl
- Size 4KB
- SHA256 36e9d90a460aa9e224ab8fc07c0b1f73cce6dca30dff82e5e59993d6d0859e2d
- MD5 5646e42da43de31842632c49464074a5
- SHA1 d771165ddabaded1600a352dab073600fd40842c
- SHA512 0df38c67c27d11ee8116e4418e8cefef3b72d9ce7183f79d70b2cef03277d8c7fae7d01ca8122fd13c2101ea5ba74b67e4f3778aabc0f19767d2ac1abbcbd0db
- SSDEEP 96:FsGOgFb/jAm2Tof4V4tn0BtbKwDzpRHjvGo4EVHpymfLfUQ:tOgFbN2kQOAtuSzDGo4EVHptUQ
- TLSH
  T19D91D6EA73D0253AE31645237C3A6649FE3880DF03E9692A3D4FEB14BB5700116B0B98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral22
- Target
  lib/tk/demos/widget
- Size 22KB
- SHA256 273f464cfdd34d4583d2bf53f47529df13671686aee5d1c5da44c2e71428ed01
- MD5 c8dbfe9cb54b842210c9b7585c753140
- SHA1 4a799482d2bbe4ec9f7fe0c3410eca5294d1f87b
- SHA512 045090af150f7b961abfd2fd7298e5b63934a0f0a6d815bf496c4f1703e02befac7f894f4460346145b21f91c47c629d6b9a279e7396f226d696165460bd8373
- SSDEEP 384:K0rYA9qnKclByb2ROTrF4NWqeOcwj2aFwko9Kxul3XOBXZhD71XfORPaTwyTs3IZ:3rYA9qnKy22R6EWfab26ZtJDTwyAUP
- TLSH
  T125A2F817374816A6AB93C4777DCF6104EE34D0A75A5BE84C74AF8168AF6222381FD3E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  lib/tk/entry.tcl
- Size 16KB
- SHA256 8f57a23c5190b50fad00bdee9430a615ebebfc47843e702374ae21beb2ad8b06
- MD5 be28d16510ee78ecc048b2446ee9a11a
- SHA1 4829d6e8ab8a283209fb4738134b03b7bd768bad
- SHA512 f56af7020531249bc26d88b977baffc612b6566146730a681a798ff40be9ebc04d7f80729bafe0b9d4fac5b0582b76f9530f3fe376d42a738c9bc4b3b442df1f
- SSDEEP 384:P/eFkH2fRdOnOeQod3tCAERebMIDlXVQgXwVviw:P2FDqUy8V
- TLSH
  T16F7252CA2D665B316187C1B7D6DEF600F776902B22D74826B5A593503F8903302BE7EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral24
- Target
  lib/tk/focus.tcl
- Size 4KB
- SHA256 40d4e101a64b75361f763479b01207ae71535337e79ce6e162265842f6471eed
- MD5 7ea007f00bf194722ff144be274c2176
- SHA1 6835a515e85a9e55d5a27073dae1f1a5d7424513
- SHA512 e2520eb065296c431c71dbbd5503709cf61f93e74fe324f4f8f3fe13131d62435b1e124d38e2ec84939b92198a54b8a71dfc0a8d32f0dd94139c54068fbcaaf2
- SSDEEP 96:mumhRUI7F2WyHm6BUyNhEf6jUHKRUI7F2WyQe6L763AcnK0/61sk2ko5AgEplauw:ERUQFU52CNRUQFpLOQIG1sk2TCLplauw
- TLSH
  T141A18621F64523B3B54611A325AFE34DBB7B8476528D98D87CB5C224B302417C3FE6E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral25
- Target
  lib/tk/fontchooser.tcl
- Size 15KB
- SHA256 ceb558fb76a2c85924cd5f7d3a64e77582e1d461dd9a3c10fedb4608ad440f5b
- MD5 9324dbbe37502e149474e05a3448b6e3
- SHA1 5584b4ee3bf25e95ee6919437d066586060b6e36
- SHA512 c688676452f89ec432e93a64ac369cc0b82b19d8d38d2c4034888551591f59d87548fae12a98ee7735540779566deb400c27bead2c141a9f971baf9e61c218c6
- SSDEEP 384:hrAVUJgzMAP2Xg7V5M8Zyc8Ck/YN9G4EM8CPo:hrAVUJgzMAP2Xg7V5MgycO/YpEX
- TLSH
  T1446274023594A96130D6C47F28ED91647E3DC19B5388E9A8BCFE824C6F915F262F47F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral26
- Target
  lib/tk/iconlist.tcl
- Size 15KB
- SHA256 de0195ccfb6482cca390c94e91b7877f47742e7a9468caf362b39aa36305d33c
- MD5 105529990cee968aa5ee3bc827a81a0f
- SHA1 559bd1aabd1d4719edb60448cf111f78365a57a9
- SHA512 03cb42dff7ac4f801aa7ffe8a4f07555cce6874aa1b7f568acf0299e4dd7f440179838485777f15183ee7c057ccb35868672b1783fbfe67b51d97dbbdac85281
- SSDEEP 192:xj0OECzN+8JERNLKZhbgIDx3VM5BxBTSgvpn8WYYW5Xb50To3u8PYHPtJYa5PWDx:xrDJE36a7BegvV8hFI8gvXaSn9HqD/U0
- TLSH
  T1F17285457F8491787087E23F1DD6A110E979C5A7C8C9CD0E7C299164BB2423B86FE1EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27
- Target
  lib/tk/listbox.tcl
- Size 14KB
- SHA256 39721233855e97bfa508959b6dd91e1924456e381d36fdfc845e589d82b1b0cc
- MD5 c33963d3a512f2e728f722e584c21552
- SHA1 75499cfa62f2da316915fada2580122dc3318bad
- SHA512 ea01d8cb36d446ace31c5d7e50dfae575576fd69fd5d413941eebba7ccc1075f6774af3c69469cd7baf6e1068aa5e5b4c560f550edd2a8679124e48c55c8e8d7
- SSDEEP 384:ZBjtAc4YusFvbg36UFchqHjNw8wSdy+1a22YDE/q:ZFgqUBjW8RQcf
- TLSH
  T14D6230C47C797B7171CFC06B0ADAAB85F7B9818B0199584174ACD464BF448B282FE2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral28
- Target
  lib/tk/megawidget.tcl
- Size 9KB
- SHA256 d454fc4e25d9dfc704556a689a17aa6f3d726f99592995952bc6492fc8f19f6e
- MD5 7176a4fe8ec3ea648854f1fc1bb2ea89
- SHA1 28d96419585881c6222bc917edb9a5863e7c519b
- SHA512 8c33e1cd3490945ddc5da0585e655a7fc78c9950886f68c096d103ae510c1024632ab3d41e9573937bb4359d365ffb8f5a10b1ca7bfbd37442f40985107c1c8d
- SSDEEP 192:cp4NSZKF/bcaQTViJ8pox8tJRd/v0tAANQSLkROOp+4BQjBC:jSZKF/Iaarpocdn07NQS34ao
- TLSH
  T1421232456285536E37D7A3B5449E61489538C2BFDDEB9C2C3C9EC3C83B108B285F62D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29
- Target
  lib/tk/menu.tcl
- Size 37KB
- SHA256 564ac0040176cc5744e3860abc36b5ffbc648da20b26a710dc3414eae487299b
- MD5 181ed74919f081eeb34269500e228470
- SHA1 953eb429f6d98562468327858ed0967bdc21b5ad
- SHA512 220e496b464575115baf1dede838e70d5ddd6d199b5b8acc1763e66d66801021b2d7cd0e1e1846868782116ad8a1f127682073d6eacd7e73f91bced89f620109
- SSDEEP 768:0K5IzCPGH0a9tVbQDBTo06DpSCeihpzuxdyQYEuH9DAe1:0K5i1HDE6AWuxdRYxHS8
- TLSH
  T10703A4809F49F333A103C2B546DB9194FB7982E357895C9C345C93AC7B898274AFE6E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30
- Target
  lib/tk/mkpsenc.tcl
- Size 28KB
- SHA256 0ac9d11d4046ef4d8e6d219f6941bf69c6ae448c6a1c2f7fc382f84b5786f660
- MD5 5f3793e7e582111c17c85e23194aefd5
- SHA1 925d973b70252384d1de9b388c6c2038e646fddf
- SHA512 2922546ba69232dbc205fe83ef54916e334e7ac93b7a26a208341f9c101209da84c73f48c52bdb8e63e71a545853652b86378ebeb88f000bc16fcfb0ef5d8517
- SSDEEP 768:hmie+xwcBO/SHAqFySrhkvQueYpx8DPF52qdREXXZ2/OODi:I+xwcBO/SHAqFySrhAQueYD8D95TOL
- TLSH
  T162D2D8598F911D77F24709538B0B44EE902DD43E77796828F46CCA5C3B0182E8AFB9B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31
- Target
  lib/tk/msgbox.tcl
- Size 16KB
- SHA256 52c5b87c99c142d5fc77e0c22b78b7cd63a4861756fd6b39648a2e9a8edde953
- MD5 c93f295967350f7010207874992e01a5
- SHA1 cae8ef749f7618326b3307da7ed6debb380286dd
- SHA512 f7e60211c0bc1ecede03022d622c5b9aaeae3c203a60b6b034e1886f857c8fad6ba6b1f7ba1ee7d733720775e7108f1bfd4c5b54a0f4919ce4eb43851d1190f8
- SSDEEP 384:aWsDPYblrrfcRcfjAwnAVDTS3ifQjvwMXEcjY:aTRcfjAwGTfQjvPXt0
- TLSH
  T105722BC773983166B563943EDFDA820266BCA4FB58D17C497C5D8098EBD901AC1F13AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32