Malicious
DotNetZip.dll
PE Executable
MD5: 087f511d832b839f1f4c7285d65c7ec7
Size: 457.73 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
457.73 KB · 457,728 B
First seen
2026-10-25 19:21 · 4 hours ago
Last seen
2026-10-25 19:21 · 4 hours ago
Last analysis
2026-10-25 19:21 · 4 hours ago
Hashes
MD5
087f511d832b839f1f4c7285d65c7ec7
Sha1
4af23240d46bc8335df815ce8618d2aac11b65c1
Sha256
7dd20a2291b05323bba04be4ae656d7635ae5e68a5a6fa2b9f86e27841846a31
Sha384
c840f4e9fc4143057eff170896dd91aacbd3b55e2a3697b60b97e3b086bef5fec8a1565814e82e871d13cff53b17ebd5
Sha512
51c2e911bc5804f420d8ab67b9ff13918528a30a47228457e149d247fe360a9d51ff91416099d6f3d5da91d594e7b76e9c64e5ce645ed79c1f60d75f5f123f36
SSDeep
6144:ZRYYIiJaeEWfTXQyu8+yi4ZiwAEsFdnQ6uw2lQc2RGtSV41OJDsTDDr1LUe6GNxo:ZF9agBr6ilLS4msT1oe6kf+
TLSH
6AA49D0127D84B5BE1FF5779D0B691A1C3B2B566A93EEB9F6D4024EE1C16380D810BB3
Detection
Symbol obfuscation
Low
6 malicious · 21 files
DLLDotNetZip.dllT1027 · T1105 · T1059.001
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINIonic.Zip.Forms.PasswordDialog.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINIonic.Zip.WinFormsSelfExtractorStub.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINIonic.Zip.Forms.ZipContentsDialog.resources
ZIPIonic.Zip.Resources.ZippedResources.zipT1027 · T1105 · T1059.001
CSCommandLineSelfExtractorStub.cs
PS1FolderBrowserDialogEx.csT1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
CSPasswordDialog.cs
CSPasswordDialog.Designer.cs
CSWinFormsSelfExtractorStub.cs
CSWinFormsSelfExtractorStub.Designer.cs
CSZipContentsDialog.cs
CSZipContentsDialog.Designer.cs
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 4
STICH kept: 1secondary ignored: 3
bin
3Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:dll>arc:zip>scr:ps1~T1027~T1059.001~T1105
Shape
pe:dll>arc:zip>scr:ps1
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Info | PDB Path: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb |
| Module Name | DotNetZip.dll |
| Full Name | DotNetZip.dll |
| Scope Name | DotNetZip.dll |
| Scope Type | ModuleDef |
| Kind | Dll |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | DotNetZip |
| Assembly Version | 1.11.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | True |
| PublicKey Token | 6583c7c814667745 |
| Target Framework | <null> |
| Total Strings | 775 |
| Main Method | Not found or no body |
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 21 files
DLLDotNetZip.dllT1027 · T1105 · T1059.001
Structure
BINResources
BIN.Net Resources
BINIonic.Zip.Forms.PasswordDialog.resources
BINIonic.Zip.WinFormsSelfExtractorStub.resources
BINIonic.Zip.Forms.ZipContentsDialog.resources
ZIPIonic.Zip.Resources.ZippedResources.zipT1027 · T1105 · T1059.001
CSCommandLineSelfExtractorStub.cs
PS1FolderBrowserDialogEx.csT1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
CSPasswordDialog.cs
CSPasswordDialog.Designer.cs
CSWinFormsSelfExtractorStub.cs
CSWinFormsSelfExtractorStub.Designer.cs
CSZipContentsDialog.cs
CSZipContentsDialog.Designer.cs
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
DotNetZip.dll › .Net Resources › Ionic.Zip.Resources.ZippedResources.zip › FolderBrowserDialogEx.cs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account