Malicious ZIP Archive analysis – 7059da6590f3

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

Size

18.93 MB · 18,934,951 B

First seen

2025-07-21 05:45 · one year ago

Last seen

2025-07-21 05:45 · one year ago

Last analysis

2025-07-21 06:03 · one year ago

Hashes

MD5 46b5747b94d209143afc98c1e8875dcf Sha1 528d9f75b05fad84525b7ed64ec96f26acff6ca6 Sha256 7059da6590f3b30dbcf160b2d2ec731dedfecfdaccace14f236e3fffb7812cb0 Sha384 dbfd0ac6256c16b18c60600bc827474f576b1b0431d8b870733f9e66b1c2d2ea5cade11dc8207821d834ed79cf262b98 Sha512 9fb46cb009acc5a304ba4ad75019d367dcec68d2e368a10897a215e60659649575481ee48a06ffd3fc7495ffec809ca9ebc0b6c31f34d22e1b09e96109f0e618 SSDeep 393216:QJvqE/G4IqGmp/XWohTCfB5Hz45qFPBCuJZckVJfvf0ibuXcB4pMxEpkPr:2jG7zSXWVfjfFJCn0Jf4XcupMxiYr TLSH 8017331AC86D4DA2EC9BB7B813FD57C8854A864D7873602E5AD981CDCD83CC95B03E4E

3 malicious · 1095 files

ZIP46b5747b94d209143afc98c1e8875dcf

BINlib

EXE_asyncio.pyd

EXE_bz2.pyd

EXE_cffi_backend.cp311-win_amd64.pyd

EXE_ctypes.pyd

EXE_decimal.pyd

EXE_hashlib.pyd

EXE_lzma.pyd

EXE_multiprocessing.pyd

EXE_overlapped.pyd

EXE_queue.pyd

EXE_socket.pyd

EXE_ssl.pyd

EXE_win32sysloader.pyd

BINasyncio

BINcertifi

BINchardet

BINcharset_normalizer

BINcollections

BINconcurrent

BINcryptography

BINctypes

BINemail

BINencodings

BINhttp

BINidna

BINimportlib

BINjson

BINjwt

DLLlibcrypto-3.dll

DLLlibffi-8.dll

DATlibrary.dat

ZIPlibrary.zip

DLLlibssl-3.dll

BINlogging

DLLmfc140u.dll

BINmultiprocessing

EXEpyexpat.pyd

DLLpythoncom311.dll

BINpywin

DLLpywintypes311.dll

BINre

BINrequests

EXEselect.pyd

EXEunicodedata.pyd

BINurllib

BINurllib3

BINvdf

EXEwin32api.pyd

BINwin32com

PYC__init__.pyc

BINclient

BINHTML

BINinclude

BINlibs

TXTLicense.txt

HTMLreadme.html

BINtest

IDLpippo.idl

TXTreadme.txt

VBStestDictionary.vbs

VBStestInterp.vbs

VBSTestpys.sct

VBStestPyScriptlet.js

VBStestPyScriptlet.js.deobfuscated.vbs

VBStestxslt.js

XSLtestxslt.xsl

EXEwin32crypt.pyd

EXEwin32event.pyd

EXEwin32ui.pyd

BINxml

BINxmlrpc

IMGmanual.png

EXEManualsUpdateService.exe

DLLpython3.dll

DLLpython311.dll

IMG¥Þ¥Ë¥å¥¢¥ë.png

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

thuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\phuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

thuhuhuhu

PDB Path PATH

cryptohuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\phuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\phuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\phuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\phuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\phuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\phuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\1huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential