Suspicious
Suspect

6b96c748c5689ae5ae58ee0adf9e3efb

ZIP Archive
MD5: 6b96c748c5689ae5ae58ee0adf9e3efb
Size: 538.36 KB
application/zip

This sample is a 525.7 KB ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
67197f64764990795499e89fa296dd63b65d1e29c20cf98bc11df1ab5b6c04a5
MD5
6b96c748c5689ae5ae58ee0adf9e3efb
Verdict
Inconclusive
File type
ZIP Archive · 525.7 KB

Cite this report: https://app.malva.re/sha256/67197f64764990795499e89fa296dd63b65d1e29c20cf98bc11df1ab5b6c04a5

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
538.36 KB · 538,362 B
First seen
2026-10-06 08:31 · 25 days ago
Last seen
2026-10-06 08:31 · 25 days ago
Last analysis
2026-10-06 08:31 · 25 days ago
Hashes
MD5 6b96c748c5689ae5ae58ee0adf9e3efb Sha1 d998be62a3a9c8542966ebc86a0de735eb3a31f8 Sha256 67197f64764990795499e89fa296dd63b65d1e29c20cf98bc11df1ab5b6c04a5 Sha384 ee725540552b2929bbbc13781400bf430b3fca8d5a8980ed522be774fbde8358c907e6792a6f5ae3d90dc4a1ef8b06a3 Sha512 830cd17454257fad35058b34747a92be91f56966e99a881fbd30589cce7b83605b7fd7bb3d9c4bcb545120862d4d8e76368f59631fe307297d2f704eaa62a3d9 SSDeep 12288:HrLZ+vPYN9Vr64fQ/IPI2si0Ndq7r04rxkF56zm5vI:LLZ+vwN9Z6qQQAHi0mgUmNI TLSH 08B433F5AC68721A176F9D13E762EBD03B7DC3AC265313C42527A2CC404B96B116E3C9

4 files
ZIP6b96c748c5689ae5ae58ee0adf9e3efb
CMDLauncher.cmd
EXElua51.exe
Structure
TXTrest.txt
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:exe
Shape arc:zip>pe:exe
2 nodes

4 files
ZIP6b96c748c5689ae5ae58ee0adf9e3efb
CMDLauncher.cmd
TXTrest.txt
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙