Malicious
258aa2891f92620aa8540ab6ba13c9f4
ZIP Archive
MD5: 258aa2891f92620aa8540ab6ba13c9f4
Size: 13.09 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
13.09 KB · 13,093 B
First seen
2026-06-30 18:16 · 3 months ago
Last seen
2026-06-30 18:16 · 3 months ago
Last analysis
2026-07-02 00:20 · 3 months ago
Hashes
MD5
258aa2891f92620aa8540ab6ba13c9f4
Sha1
2167099d63bf1d92b02241312f467a5acbf4f181
Sha256
a1dbae0dd3e1d72f649be1c8a999274a22127ed27165018af1d96b7d6eda9baa
Sha384
0cc2832d5b2c014cdfe468d809b2e21ee2b4c469cc10e05811bbe55465d616e4b4e7c2643c164894b44215cfa334cd28
Sha512
5e4ab4a29737fbe010b3bf6bf46d57ba90293f7e51df64a599b9162363ba56c4f95c5b320c71ae5a1c46b4051bd5b4f28988c8ac7a80bbdfe42c1a8a48829857
SSDeep
48:V7PtJeQqTellc51WUrfAx7PUuuGJIEuqTelA51WUSxB1Bg/E7o/j27H:V7lJe7ellcn7i7suuGJIYelAnCT7J7H
TLSH
0E42AF8036E86304F2B2BE3DDE3A5B404537BAD0EE35839C8A10DC1D1966611CD74F36
16 malicious · 16 files
ZIP258aa2891f92620aa8540ab6ba13c9f4T1059.001 · T1059.003 · T1059.005LOLBin
LNKNAKAZ_MO_perevirka_mayna.docx.lnkT1059.001 · T1059.003 · T1204.002LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
LNKSPYSOK_mayna.docx.lnkT1059.001 · T1059.003 · T1059.005LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]T1059.005
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary].deobfuscated.vbsT1059.005
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential16 malicious · 16 files
ZIP258aa2891f92620aa8540ab6ba13c9f4T1059.001 · T1059.003 · T1059.005LOLBin
LNKNAKAZ_MO_perevirka_mayna.docx.lnkT1059.001 · T1059.003 · T1204.002LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
LNKSPYSOK_mayna.docx.lnkT1059.001 · T1059.003 · T1059.005LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]T1059.005
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary].deobfuscated.vbsT1059.005
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
258aa2891f92620aa8540ab6ba13c9f4 › SPYSOK_mayna.docx.lnk
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
258aa2891f92620aa8540ab6ba13c9f4 › SPYSOK_mayna.docx.lnk › [Lnk Summary]
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
258aa2891f92620aa8540ab6ba13c9f4 › SPYSOK_mayna.docx.lnk › [Lnk Summary] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
258aa2891f92620aa8540ab6ba13c9f4 › SPYSOK_mayna.docx.lnk › LNK CommandLine › [PowerShell Command]
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
258aa2891f92620aa8540ab6ba13c9f4 › NAKAZ_MO_perevirka_mayna.docx.lnk
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
258aa2891f92620aa8540ab6ba13c9f4 › NAKAZ_MO_perevirka_mayna.docx.lnk › [Lnk Summary]
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
258aa2891f92620aa8540ab6ba13c9f4 › NAKAZ_MO_perevirka_mayna.docx.lnk › [Lnk Summary] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
258aa2891f92620aa8540ab6ba13c9f4 › NAKAZ_MO_perevirka_mayna.docx.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account