Malicious
27eb6e1be8d3d4878bb6c3575300c70b
ZIP Archive
MD5: 27eb6e1be8d3d4878bb6c3575300c70b
Size: 614 B
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
614 B · 614 B
First seen
2026-08-03 08:48 · 2 months ago
Last seen
2026-08-03 08:48 · 2 months ago
Last analysis
2026-08-03 08:48 · 2 months ago
Hashes
MD5
27eb6e1be8d3d4878bb6c3575300c70b
Sha1
42d95697459381939e7e2bcb553a1c73e0c7288d
Sha256
c25b0dda08087484b4db248145581ee7d494dbf47913bc28246213951fa9cffd
Sha384
307f46e3a50dea764d534ad85a9b740223f9869c16e19577f80d45907309ae754c36d8774d5e25b966ba64ed34c704df
Sha512
4f451c2e0d9bec228e5e675b41a81afb1e9a832479c9c4104db62171da44ac9a1b2b090c3006b19a7dbce470441c6ec9f27b0f79a62d7c25b497a442a9eabdda
SSDeep
12:5jGj/r+LUY4YfLNFShRt/kUuKQJTbZQXPMgH7xNgaIaG:9G3YfBFkTcvdbZQXPJ7Dg7
TLSH
7DF0B7EC472B71C8C10301F526033E351B5671220B085FCC28356B2A45F4B87BF024EC
3 malicious · 3 files
ZIP27eb6e1be8d3d4878bb6c3575300c70bT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
LNKALVESHOTEL_VOUCHER--YI04AD.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.003~T1202~T1204.002
Shape
arc:zip>lnk
malicious
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 3 files
ZIP27eb6e1be8d3d4878bb6c3575300c70bT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
LNKALVESHOTEL_VOUCHER--YI04AD.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
27eb6e1be8d3d4878bb6c3575300c70b › ALVESHOTEL_VOUCHER--YI04AD.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account