Malicious
ZIP Archive
MD5: 09044a44477b8aacde568a6a941a851b
Size: 121.34 KB
application/zip
Ctrl + scroll to zoom · drag to pan
This sample is a 118.5 KB ZIP Archive classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- d1ba8fa2065392a239cc09fc52fe7611f749e982d4b80d9fb389a35972c251b8
- MD5
- 09044a44477b8aacde568a6a941a851b
- Verdict
- Malicious
- File type
- ZIP Archive · 118.5 KB
Cite this report: https://app.malva.re/sha256/d1ba8fa2065392a239cc09fc52fe7611f749e982d4b80d9fb389a35972c251b8
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
121.34 KB · 121,335 B
Hashes
MD5
09044a44477b8aacde568a6a941a851b
Sha1
da235c3eff3fa1628286b9e1ca72c4b64c8be278
Sha256
d1ba8fa2065392a239cc09fc52fe7611f749e982d4b80d9fb389a35972c251b8
Sha384
9f69aaf8c7a3f2f1d3fbfc54e9ff17b552c1c9e125d894ce1630099da19cbd8763fdab699bb2668b67c0c10caf45e197
Sha512
8c285e4d036f13aab53a09cba97e847a1763e3d15c2e91a1c077bd76963c72e76d8801e83c7d253fc0b86a84d6216556ad948cb816fedceb25fe7a1e278027f7
SSDeep
3072:USAPPm8TOgEvo/NDS8ca5w8x2O0LYEIGM2:USyPmBTiN/n2O0LY/2
TLSH
44C3120520CA7D25A0B42516691407722F673DB73B2D0E1D0BDDE03AABC44FA97E69FE
3 malicious · 3 files
ZIP09044a44477b8aacde568a6a941a851bT1027 · T1059.005
VBSBallasteringen.vbsT1027 · T1059.005
VBSBallasteringen.vbs.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:vbs~T1027~T1059.005
Shape
arc:zip>scr:vbs
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential