Malicious
Malicious

2e25e45e61f637ae690347e72e5ffc52

ZIP Archive
MD5: 2e25e45e61f637ae690347e72e5ffc52
Size: 901 B
application/zip

This sample is a 901 bytes ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
bfc6698a161a47d9655dc273b874a31727189dd1ef2d85e7740b85c72c1dff1d
MD5
2e25e45e61f637ae690347e72e5ffc52
Verdict
Malicious
File type
ZIP Archive · 901 bytes
Category
LOLBin

Cite this report: https://app.malva.re/sha256/bfc6698a161a47d9655dc273b874a31727189dd1ef2d85e7740b85c72c1dff1d

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
901 B · 901 B
First seen
2026-08-03 08:30 · 2 months ago
Last seen
2026-08-03 08:30 · 2 months ago
Last analysis
2026-08-03 08:30 · 2 months ago
Hashes
MD5 2e25e45e61f637ae690347e72e5ffc52 Sha1 2631809238480ba65b722d7534998f3399b7ad45 Sha256 bfc6698a161a47d9655dc273b874a31727189dd1ef2d85e7740b85c72c1dff1d Sha384 831187fe4c03167a2615858fcaeaf8f082c9605305706b78fee3e6b83ffe3e6ebdad42e6a97d614eb17076a214e98905 Sha512 28bbddb6c0fbbcc0157007ea5d95f31b6ea903a1fb189983ebda75a53a261e495a459a3d0a529102837a11fa9ff7ac5ed83b6295159dd3d63a5c12a4c3c68b55 SSDeep 24:9qHRilXSSX1N3W7ukID5HyIKNZXkbd+Wdhq8sBMYic:9iRiXrTGKkU7KDUx+We8sB1V TLSH 531144379C5B61CAF10711B0D00A55B135AAE0D4DD7E265322BCA6F580B16809790A44

3 malicious · 3 files
ZIP2e25e45e61f637ae690347e72e5ffc52LOLBin
LNKContrato_Indeniza_Brasil-WBOL65.lnkLOLBin
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.003~T1202~T1204.002
Shape arc:zip>lnk
malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 3 files
ZIP2e25e45e61f637ae690347e72e5ffc52LOLBin
LNKContrato_Indeniza_Brasil-WBOL65.lnkLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
2e25e45e61f637ae690347e72e5ffc52 › Contrato_Indeniza_Brasil-WBOL65.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙