Malicious
Malicious

6cfc9012ed6036fe521c96e918d3b272

ZIP Archive
MD5: 6cfc9012ed6036fe521c96e918d3b272
Size: 889 B
application/zip
Ctrl + scroll to zoom · drag to pan

This sample is a 889 bytes ZIP Archive classified as malicious by Malva.RE (lolbin). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
fa3cdaffc552050ae23ec734b927b3e4d20808fc1151ef1cdfcad5c4327e8aff
MD5
6cfc9012ed6036fe521c96e918d3b272
Verdict
Malicious
File type
ZIP Archive · 889 bytes
Category
LOLBin

Cite this report: https://app.malva.re/sha256/fa3cdaffc552050ae23ec734b927b3e4d20808fc1151ef1cdfcad5c4327e8aff

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
889 B · 889 B
Hashes
MD5 6cfc9012ed6036fe521c96e918d3b272 Sha1 263d933e9f166157bb9d362e2eb9f594091187c9 Sha256 fa3cdaffc552050ae23ec734b927b3e4d20808fc1151ef1cdfcad5c4327e8aff Sha384 218c9bff6bcccb72dca2b693dba6c66748f1f9691dbf4bec7c1ccde06f1630b461ff918c2377e697ee43011be5aca48f Sha512 223fba8456e68ce63c6950badfcc1281c7a667c2da36992f012ceeb1c0075ead2959fc304b25a3091dbee81b224e5f492584c15728cc66cbf3796e7593950515 SSDeep 24:9UaOgUmPe/HGGkWNBNzL6qi6lggPV+PqgX1:9UCUgmHSWNzLCbCyqgX1 TLSH B211967159194A76CA4305B597724E23C125C0190F87C2D289F8E14E0CFA89179CD6D4

3 malicious · 3 files
ZIP6cfc9012ed6036fe521c96e918d3b272LOLBin
LNKDOC-D3F9YH.lnkLOLBin
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.003~T1202~T1204.002
Shape arc:zip>lnk
malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 3 files
ZIP6cfc9012ed6036fe521c96e918d3b272LOLBin
LNKDOC-D3F9YH.lnkLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
6cfc9012ed6036fe521c96e918d3b272 › DOC-D3F9YH.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙