Suspect
ZIP Archive
MD5: 3009d195b5ffe3c87dbd168dfe658603
Size: 47.14 KB
application/zip
This sample is a 46 KB ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 88 embedded or derived files. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb
- MD5
- 3009d195b5ffe3c87dbd168dfe658603
- Verdict
- Inconclusive
- File type
- ZIP Archive · 46 KB
Cite this report: https://app.malva.re/sha256/07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
47.14 KB · 47,135 B
First seen
2026-10-22 15:01 · 4 days ago
Last seen
2026-10-22 15:01 · 4 days ago
Last analysis
2026-10-22 15:01 · 4 days ago
Hashes
MD5
3009d195b5ffe3c87dbd168dfe658603
Sha1
791862cae203f32d08832931b6a040d924c1ad75
Sha256
07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb
Sha384
bbd31b71ddb64a7af033fb84d4ab349ea2b1220c96d8d70645cb21b5e6c603ce3f8b0ab21ce9d2b8b9a6e16bb4986e13
Sha512
91f9fa1f84257508d4fb9889131ce61a85f9db5b8ba877d1d1e8ac1c55ad5d162c58d0b0af5dce28e5aba717ffc4729687764c3fa76dca218711059a69fe1e95
SSDeep
768:5CAdya0bLPp66ouuYSpXubY1yuNyGEH1mP1oEprb1qz27Ruyvuw:n8z06ouu/5ubPuNHEVmNtV1h9d2w
TLSH
EB23F1160D52DA401A1EDB30B47E6F07EBAA521F983C3A8D6C2FF0C167A1725C74629F
89 files
ZIP3009d195b5ffe3c87dbd168dfe658603
EMLHumanitarian assistance indicators_ displacement and support metrics.msg
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 3
STICH kept: 1secondary ignored: 2
bin
2Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>msg>eml
Shape
arc:zip>msg>eml
3 nodes
Received
WORDING
from Chuhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from Chuhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from Phuhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from fhuhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from lhuhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from Mhuhuhuhuhuhuhuhuhuhuhu
X-CSE-ConnectionGUID
WORDING
ySHtbMhuhuhuhuhuhuhu
X-CSE-MsgGUID
WORDING
BVrIiDhuhuhuhuhuhuhu
Received-SPF
WORDING
Pass (huhuhuhuhuhuhuhuhuhuhu
Received-SPF
WORDING
None (huhuhuhuhuhuhuhuhuhuhu
Authentication-Results
WORDING
mx10.chuhuhuhuhuhuhuhuhuhuhu
IronPort-SDR
WORDING
6a6cf2huhuhuhuhuhuhuhuhuhuhu
X-ThreatScanner-Verdict
WORDING
Nehuhuhuhu
X-IPAS-Result
WORDING
A0HjEghuhuhuhuhuhuhuhuhuhuhu
IronPort-PHdr
WORDING
A9a23:huhuhuhuhuhuhuhuhuhuhu
IronPort-Data
WORDING
A9a23:huhuhuhuhuhuhuhuhuhuhu
IronPort-HdrOrdr
WORDING
A9a23:huhuhuhuhuhuhuhuhuhuhu
X-Talos-CUID
WORDING
9a23:whuhuhuhuhuhuhuhuhuhuhu
X-Talos-MUID
WORDING
9a23:Vhuhuhuhuhuhuhuhuhuhuhu
X-IronPort-Anti-Spam-Filtered
WORDING
thuhuhuhu
X-IronPort-AV
WORDING
E=Sophhuhuhuhuhuhuhuhuhuhuhu
X-MGA-submission
WORDING
MDH3H3huhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from shuhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from dhuhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from dhuhuhuhuhuhuhuhuhuhuhu
X-TM-AS-ERS
WORDING
172.30huhuhuhuhuhuhuhuhuhuhu
X-TM-AS-SMTP
WORDING
1.0 d3huhuhuhuhuhuhuhuhuhuhu
X-DDEI-TLS-USAGE
WORDING
Uhuhuhuhu
Received
WORDING
from whuhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from whuhuhuhuhuhuhuhuhuhuhu
Received
WORDING
from whuhuhuhuhuhuhuhuhuhuhu
X-Trellix
WORDING
Chuhuhuhu
From
EMAIL
Moustahuhuhuhuhuhuhuhuhuhuhu
To
EMAIL
"dql.rhuhuhuhuhuhuhuhuhuhuhu
Subject
WORDING
Humanihuhuhuhuhuhuhuhuhuhuhu
Thread-Index
WORDING
AQHdIRhuhuhuhuhuhuhuhuhuhuhu
Date
WORDING
Fri, 3huhuhuhuhuhuhuhuhuhuhu
Message-ID
WORDING
<7ff8fhuhuhuhuhuhuhuhuhuhuhu
Accept-Language
WORDING
en-Ghuhuhuhu
X-MS-Has-Attach
WORDING
x-ms-exchange-messagesentrepresentingtype
WORDING
1huhuhuhu
x-ms-exchange-transport-fromentityheader
WORDING
Hohuhuhuhu
x-originating-ip
WORDING
[172.huhuhuhuhuhuhu
X-TM-AS-Product-Ver
WORDING
SMEX-1huhuhuhuhuhuhuhuhuhuhu
X-TM-AS-User-Approved-Sender
WORDING
Nhuhuhuhu
MIME-Version
WORDING
1huhuhuhu
X-TMASE-Result
WORDING
10--11huhuhuhuhuhuhu
X-TMASE-MatchedRID
WORDING
P7xEEPhuhuhuhuhuhuhuhuhuhuhu
X-TMASE-SNAP-Result
WORDING
1.8210huhuhuhuhuhuhuhuhuhuhu
X-TMASE-INERTIA
WORDING
0-huhuhuhu
X-TMASE-XGENCLOUD
WORDING
78b7fchuhuhuhuhuhuhuhuhuhuhu
X-TM-AS-Result
WORDING
No-10-huhuhuhuhuhuhu
DKIM-Signature
WORDINGmalicious
v=1; ahuhuhuhuhuhuhuhuhuhuhu
Return-Path
WORDING
moustahuhuhuhuhuhuhuhuhuhuhu
X-MS-Exchange-Organization-Network-Message-Id
WORDING
a572e4huhuhuhuhuhuhuhuhuhuhu
X-TM-SNTS-SMTP
WORDING
95DBC6huhuhuhuhuhuhuhuhuhuhu
X-MS-Exchange-Organization-AVStamp-Mailbox
WORDING
SMEXithuhuhuhuhuhuhuhuhuhuhu
X-MS-Exchange-Organization-SCL
WORDING
0huhuhuhu
X-MS-Exchange-Organization-AuthSource
WORDING
PB-P-Ehuhuhuhuhuhuhuhuhuhuhu
X-MS-Exchange-Organization-AuthAs
WORDING
Anohuhuhuhu
X-MS-Exchange-Transport-EndToEndLatency
WORDING
00:00huhuhuhuhuhuhu
X-MS-Exchange-Processed-By-BccFoldering
WORDING
15.0huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential