Malicious
Malicious

22ea8050981382cadb5dab9f8dd43be5

ZIP Archive
MD5: 22ea8050981382cadb5dab9f8dd43be5
Size: 601 B
application/zip
Ctrl + scroll to zoom · drag to pan

This sample is a 601 bytes ZIP Archive classified as malicious by Malva.RE (lolbin). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
5a89adcd0846d7d18624e858887ab94f299f2aac23d88800ff0bffd26407dec6
MD5
22ea8050981382cadb5dab9f8dd43be5
Verdict
Malicious
File type
ZIP Archive · 601 bytes
Category
LOLBin

Cite this report: https://app.malva.re/sha256/5a89adcd0846d7d18624e858887ab94f299f2aac23d88800ff0bffd26407dec6

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
601 B · 601 B
First seen
2026-08-03 12:23 · 2 months ago
Last seen
2026-08-03 12:23 · 2 months ago
Last analysis
2026-08-03 12:23 · 2 months ago
Hashes
MD5 22ea8050981382cadb5dab9f8dd43be5 Sha1 4b4d8f297edb44636f88bf26367d8dba7036fed5 Sha256 5a89adcd0846d7d18624e858887ab94f299f2aac23d88800ff0bffd26407dec6 Sha384 eb79221f0278fd1df46568ba45eafd0284a9e2681a4dfd635ccec4add03c33a0907b1c1eeeac61bd42a6bfbba7166526 Sha512 fb98b235acecd5dc001713e101f818d727d684d9abe5ac54876f2edf228b8049c7333ae139df22762821e4a02344be3c47286afbe94a65dc79aefea2472663e7 SSDeep 12:5jPqMW0/lc4H8RVM3Z8N4sKNH/xXQYhiLfSCnkL6I3+f3pDl8uf4hRhNdMW0Pa8:9iX6lcK8RV2VsKNZFiLlkL6JDl8VRRXa TLSH 54F047E4F114C455C927FCFCB0D86544047BC41BC9A379132234D8E10E057036F85660

3 malicious · 3 files
ZIP22ea8050981382cadb5dab9f8dd43be5LOLBin
LNKNota_Fiscal_-9YL4X8.lnkLOLBin
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.003~T1202~T1204.002
Shape arc:zip>lnk
malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 3 files
ZIP22ea8050981382cadb5dab9f8dd43be5LOLBin
LNKNota_Fiscal_-9YL4X8.lnkLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
22ea8050981382cadb5dab9f8dd43be5 › Nota_Fiscal_-9YL4X8.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙