Malicious
ZIP Archive
MD5: 5569ffc4b5af007bb5e99760aba03565
Size: 28.87 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 5569ffc4b5af007bb5e99760aba03565 |
| Sha1 | ad65332d661e97646b4eef0af3a2b9eea4a0a200 |
| Sha256 | 5acb6348c394b02580af1e91a5361eddf636b544e44e8c8329c3985323a84b98 |
| Sha384 | e19e6794a45b5aba309ceedb467bdf3bcd8b82fa7c5c47ab2d16af3d4efe6283cf51eb04504de3aa1a44af38e8ed220a |
| Sha512 | ca572345d3c1658b3cf5ced7aaa3e0e4d7208d93d2c91571c19a8fffde6c1bfbf10c42431e621887bd907ae62a5733dca8a4374986aedc2562ed6f212b5ca3c4 |
| SSDeep | 393216:Mp1s22O5WlYLRVCdC7AAU9u1xc6QmMVwbRZTqBfLqqrOjVw/rVjEV1rL2vaWlYLK:g1siWiLWfQUpcRAzqqrOaNK1rfWiLeH |
| TLSH | DD57331215EA1FD1C96F4A3AE1D71203325DAE4E5103D29F8738C25E2EF36F88F19669 |
Malicious
Malicious
Malicious
Malicious
Malicious
Malicious
Malicious
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
22 / 22
Path
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious
6 nodes
Path
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.4 |
| Author | Flexense Ltd. |
| CreationDate | D:20260204125540+02'00' |
| Creator | PDFCreator Version 1.2.3 |
| Keywords | DiskPulse, Disk Change Monitor |
| ModifiedDate | D:20260204125540+02'00' |
| Subject | DiskPulse Disk Change Monitor |
| Title | DiskPulse Disk Change Monitor |
| Producer | GPL Ghostscript 9.04 |
| /Producer | GPL Ghostscript 9.04 |
| /CreationDate | D:20260204125540+02'00' |
| /ModDate | D:20260204125540+02'00' |
| /Title | DiskPulse Disk Change Monitor |
| /Creator | PDFCreator Version 1.2.3 |
| /Author | Flexense Ltd. |
| /Keywords | DiskPulse, Disk Change Monitor |
| /Subject | DiskPulse Disk Change Monitor |
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential