Malicious
111d4f831f1f7b69c1e19910f0af3c5e
ZIP Archive
MD5: 111d4f831f1f7b69c1e19910f0af3c5e
Size: 902.33 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 111d4f831f1f7b69c1e19910f0af3c5e |
| Sha1 | 602db003c4dc7d863a604500e87eb0e892c923c9 |
| Sha256 | 725fa840a70c47196797db5977b2d99654063d01310e23d0887bfc4054e143cc |
| Sha384 | 468f71d50a4c25a248c7103fd4859b7b04929d844455de320c8439fe41190a73e41f10f0688a3abbeecaea37c0dcafe7 |
| Sha512 | 28565928115875904757e0fe6d2efe573c421c12c77584de01d46d967cf800e8330da95a28865607261252348dd4e5845cbfca24ac0e37200cb81a06a0852b43 |
| SSDeep | 12288:TgzOtafpCvez+ttQbQ6JMC21PbaUDJdWPFx3lhkyD3xIpT3qK40GY8L2XG2ToA8G:oONK01CaPJ9CxDXIt3jGVy22TDGa |
| TLSH | A1153353D13B457582FFA5C7A1E21EC8C8CA12E706739F945A7D08A06B91B39E78F80D |
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 4
STICH kept: 1secondary ignored: 3
bin
2img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1027~T1059.001~T1105
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.4 |
| CreationDate | D:20241211082155+03'00' |
| ModifiedDate | D:20241211082155+03'00' |
| Producer | iText 2.1.7 by 1T3XT |
| Version | 1.7 |
| CreationDate | D:20241211120352-08'00' |
| Creator | HP Scan |
| ModifiedDate | D:20241211120352-08'00' |
| Producer | HP Scan Extended Application |
| /Creator | HP Scan |
| /CreationDate | D:20241211120352-08'00' |
| /ModDate | D:20241211120352-08'00' |
| /Producer | HP Scan Extended Application |
| /ModDate | D:20241211082155+03'00' |
| /Expires | 0 |
| /CreationDate | D:20241211082155+03'00' |
| /Producer | iText 2.1.7 by 1T3XT |
Deobfuscated PowerShell
UNKNWOWNmalicious
Write-huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell
UNKNWOWNmalicious
Write-huhuhuhuhuhuhuhuhuhuhu
111d4f831f1f7b69c1e19910f0af3c5e › Запрос-спецификация от компании ООО Орбита стройпроект на октябрь 2026г.lnk › LNK CommandLine › [Base64-Block]
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhu
111d4f831f1f7b69c1e19910f0af3c5e › Запрос-спецификация от компании ООО Орбита стройпроект на октябрь 2026г.lnk › LNK CommandLine › [Base64-Block]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.