Malicious
3bb032abe134bb3feb424a4bcb8a60c5
ZIP Archive
MD5: 3bb032abe134bb3feb424a4bcb8a60c5
Size: 6.75 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
ZIP archive
Size
6.75 MB · 6,750,388 B
Hashes
MD5
3bb032abe134bb3feb424a4bcb8a60c5
Sha1
6e2242ccb537e7eeab3506eadf0e7dc4424871bc
Sha256
def67f77584966fa4db00eca160ae28bd23b8bfef4f13bea76ab2921b545f85f
Sha384
9966edb7526617512aa4b211078e3c7bfc996dc910f9d3df1c25208ae0e96c8f92d3ce04d9a22b97ac76d2ebf4fd2ecc
Sha512
8e785e5ec6c433507aa8c30aa9534a7981a35c8f49dedbc7fbce139d1328de7b565aacebddce8f3649cbc4259f4720c9e7ec0376a07a93c7c32cf4cd1e8328d6
SSDeep
196608:/gRB8iXL+845hkxPnr84g2nH8s7UujK6+UtEE+1cPp:4rX45axT84gon7UuesiEp
TLSH
FA6633AAEA12B985CD829EF7DB5FADB032E2085827CE24DE38A45D61D7117437C05CC7
3 malicious · 28 files
ZIP3bb032abe134bb3feb424a4bcb8a60c5T1027 · T1059 · T1059.005
VBSFisc3351-Recep_CargebknDigi_Firm5657386TLQB_C8JJM.vbsT1027 · T1059 · T1059.005
VBSFisc3351-Recep_CargebknDigi_Firm5657386TLQB_C8JJM.vbs.deobfuscated.vbsT1059.005
BIN~
EXEcxbht2.xml
Structure
P7B[Authenticode]_b10ada2e.p7b
BINResources
BINRT_STRING
BINID:0FFA
BINID:0
BINID:0FFB
BINID:0
BINID:0FFC
BINID:0
BINID:0FFD
BINID:0
BINID:0FFE
BINID:0
BINID:0FFF
BINID:0
BINID:1000
BINID:0
BINRT_RCDATA
BINID:0000
BINID:0
EXEdtjog1.xml
Structure
P7B[Authenticode]_194b180a.p7b
BINResources
BINRT_MANIFEST
BINID:0002
BINID:1033
BINzertq
BINlkgutl
BINnfnhgn
BINqsrq
PDFctvklr1.pdf
BINText (Preview)
TXTPage #1
BIN#Stream obj 2 0
BIN#Stream obj 5 0
BIN#Stream obj 14 0
PDFmpiztu2.pdf
BINText (Preview)
TXTPage #1
BIN#Stream obj 23 0
BIN#Stream obj 24 0
BIN#Stream obj 29 0
BIN#Stream obj 6 0
TXTStructure
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 6
STICH kept: 1secondary ignored: 5
bin
5Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:vbs~T1027~T1059~T1059.005
Shape
arc:zip>scr:vbs
malicious
2 nodes
| Name | Value |
|---|---|
| Version | 1.4 |
| Author | LPEREZ |
| CreationDate | D:20220622164622-03'00' |
| Title | Factura A |
| Producer | ReportBuilder |
| Version | 1.3 |
| Author | MEDSIFI |
| CreationDate | D:20240910073920 |
| Creator | Form ZCSFSF_CONADEUDO ES |
| Producer | SAP NetWeaver 702 |
| /Author | MEDSIFI |
| /CreationDate | D:20240910073920 |
| /Creator | Form ZCSFSF_CONADEUDO ES |
| /Producer | SAP NetWeaver 702 |
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3 malicious · 28 files
ZIP3bb032abe134bb3feb424a4bcb8a60c5T1027 · T1059 · T1059.005
VBSFisc3351-Recep_CargebknDigi_Firm5657386TLQB_C8JJM.vbsT1027 · T1059 · T1059.005
VBSFisc3351-Recep_CargebknDigi_Firm5657386TLQB_C8JJM.vbs.deobfuscated.vbsT1059.005
BIN~
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
3bb032abe134bb3feb424a4bcb8a60c5 › Fisc3351-Recep_CargebknDigi_Firm5657386TLQB_C8JJM.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.