Malicious
561b4d321e756c05752571b54bce8a65
Tar Archive
MD5: 561b4d321e756c05752571b54bce8a65
Size: 291.33 KB
application/x-tar
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Tar archive
Size
291.33 KB · 291,328 B
First seen
2026-07-28 21:16 · 3 months ago
Last seen
2026-07-28 21:16 · 3 months ago
Last analysis
2026-07-28 21:16 · 3 months ago
Hashes
MD5
561b4d321e756c05752571b54bce8a65
Sha1
d9f554eb2d81ab6293235c42e19d4113f91b7725
Sha256
4fc548d4267d30acd658a3a43e30b4924dade9371cf6448cb1ae9e374f7dd69a
Sha384
e693c36f4de8fb34cffa398cc62af1fc0b7d41d4ad035d21332b4ec165add99ef85a94bb6c184e4a8c50da40016d88a7
Sha512
62942f25f0eb8f3b239852641d7c59e0bcb648d2ab842888860f7b033a8d28ba2d9044ab508693f0d1dcb3383d074ae745059314c9e4af21b42b9ebc12f74d2e
SSDeep
6144:oNJX3NAbLf8KTloA8rEQ4FLyj2Un161ajwC+57v5:oN28KlFLM16
TLSH
E2542B71B0C4589DE8C9C97C44E9760A0B3D7D1F8AE928AB371CEE25A7043C1BF15A67
3 malicious · 34 files
TAR561b4d321e756c05752571b54bce8a65T1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
PDFPDF @0x0002DA00
TARtreesn
DLLcalibre-launcher.dll
Structure
BINResources
BINRT_MANIFEST
BINID:0002
BINID:1033
EXEcalibre.exe
Structure
P7B[Authenticode]_72e51ee6.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
IMGID:1033
IMGID:1033-preview.png
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
PDFCGP_Заполненный_опросный_лист_по_внедрению_CommuniGate_Pro_Деловые_Линии_2026.pdf
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
BIN#Stream obj 336 0
BIN#Stream obj 339 0
BIN#Stream obj 326 0
BIN#Stream obj 329 0
BIN#Stream obj 331 0
BIN#Stream obj 334 0
BIN#Stream obj 2 0
BIN#Stream obj 139 0
BIN#Stream obj 313 0
BIN#Stream obj 345 0
TXTStructure
LNK88.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 7
STICH kept: 2secondary ignored: 5
bin
4img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:tar>lnk~T1059.003~T1202~T1204.002
Shape
arc:tar>lnk
malicious
2 nodes
Path
arc:tar>pdf
Shape
arc:tar>pdf
2 nodes
| Name | Value |
|---|---|
| Version | 1.7 |
| Author | Анна Устинова |
| CreationDate | D:20260727074647Z' |
| Creator | Calc |
| Producer | LibreOffice 25.2.3.2 (X86_64) / LibreOffice Community |
| /CreationDate | D:20260727074647Z' |
| Version | 1.7 |
| Author | Анна Устинова |
| CreationDate | D:20260727074647Z' |
| Creator | Calc |
| Producer | LibreOffice 25.2.3.2 (X86_64) / LibreOffice Community |
| /CreationDate | D:20260727074647Z' |
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 34 files
TAR561b4d321e756c05752571b54bce8a65T1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
PDFPDF @0x0002DA00
TARtreesn
PDFCGP_Заполненный_опросный_лист_по_внедрению_CommuniGate_Pro_Деловые_Линии_2026.pdf
LNK88.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
561b4d321e756c05752571b54bce8a65 › 88.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account