Malicious
ZIP Archive
MD5: 46106561962c79d6cfbc597f630ff9aa
Size: 20.23 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
20.23 MB · 20,227,273 B
First seen
2026-07-13 21:17 · 3 months ago
Last seen
2026-07-13 21:17 · 3 months ago
Last analysis
2026-07-13 21:21 · 3 months ago
Hashes
MD5
46106561962c79d6cfbc597f630ff9aa
Sha1
1592e5fe3881646b3bbda9079b3f7bb327d66762
Sha256
b999fba4d4db5bdbfa86d6744ba53b4473f37b53d0fe74c47f7c8238350a11d8
Sha384
02adac0afc0c9a2ad114268179e9e5ab747428014bc9f406ae096e18310c6f656bbb52e0ae7135ce0905f6d658d560ee
Sha512
629afae2f0bf9be5cd3c4ab8970a3447e3276df4a7a366490066d86ab968990638d0490a71f104baa3c83fd728feab0a57a8721b411cfa6fedcb101dc637ec0a
SSDeep
393216:4voJYOm4PaJBjPvwL4835pf/9vV0LCqUMMeEHjtWehhfkiI7UXFDxiOk:4voJd5EtgL445ptvV0+sMLEgh9I7m6Ok
TLSH
181723BCB4B5B95AF5D4433BC6C12CB2DB2CA540D7D93D9B8E2041927EC320E5F6A861
2 malicious · 1170 files
ZIP46106561962c79d6cfbc597f630ff9aaT1059.001CVE-2019-9674
BINbrowser
DLLdbadapt.dll
BINdefaults
BINfonts
BINgmp-clearkey
DLLpython37.dll
Structure
BINOverlay_b998d9f5.bin
BINResources
EXESetup.exe
BINuninstall
DLLvcruntime140.dll
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
26 / 26
Path
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious
6 nodes
Path
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | http:/huhuhuhuhuhuhu |
| URL #8 | http:/huhuhuhuhuhuhu |
| URL #9 | http:/huhuhuhuhuhuhu |
| URL #10 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | http:/huhuhuhuhuhuhu |
| URL #13 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #16 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #17 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #18 | http:/huhuhuhuhuhuhu |
| URL #19 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #8 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #9 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #10 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #13 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #16 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #17 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #18 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #19 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #20 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #21 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #22 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #23 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #8 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #9 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #10 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #13 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #16 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #17 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #18 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #19 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #20 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #21 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #22 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #23 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #24 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #25 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.7 |
| CreationDate | D:20201128161048 |
| Creator | http://www.helpandmanual.com |
| ModifiedDate | D:20210218152739+03'00' |
| Title | F-Rename - Hilfesystem |
| Producer | wPDF3 by WPCubed GmbH |
| /CreationDate | D:20201128161048 |
| /Creator | http://www.helpandmanual.com |
| /ModDate | D:20210218152739+03'00' |
| /Producer | wPDF3 by WPCubed GmbH |
| /Title | F-Rename - Hilfesystem |
| Version | 1.2 |
| CreationDate | D:20260423010135 |
| Creator | http://www.helpandmanual.com |
| ModifiedDate | D:20260423010135 |
| Title | F-Rename - Hilfesystem |
| Producer | wPDF3 by WPCubed GmbH |
| /Creator | http://www.helpandmanual.com |
| /Title | F-Rename - Hilfesystem |
| /CreationDate | D:20260423010135 |
| /ModDate | D:20260423010135 |
| /Producer | wPDF3 by WPCubed GmbH |
| Version | 1.2 |
| CreationDate | D:20260423010058 |
| Creator | http://www.helpandmanual.com |
| ModifiedDate | D:20260423010058 |
| Title | F-Rename - Hilfesystem |
| Producer | wPDF3 by WPCubed GmbH |
| /Creator | http://www.helpandmanual.com |
| /Title | F-Rename - Hilfesystem |
| /CreationDate | D:20260423010058 |
| /ModDate | D:20260423010058 |
| /Producer | wPDF3 by WPCubed GmbH |
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential