Malicious
ZIP Archive
MD5: 7e0c5b1a659c8ecee5c970cb7162d66a
Size: 17.84 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
17.84 MB · 17,836,347 B
First seen
2026-07-17 12:46 · 3 months ago
Last seen
2026-07-17 12:46 · 3 months ago
Last analysis
2026-07-17 17:39 · 3 months ago
Hashes
MD5
7e0c5b1a659c8ecee5c970cb7162d66a
Sha1
cf18c4eca378bfd964278f1fcf97fbe51cc6f230
Sha256
c4b117f30786d0b328d90c2818e4c454e81d29ed5921d8f8847e80333a12ee86
Sha384
dca115126d4a1c2cb5c4bc4e179fd6ca6d5fd90dbe2d9db9263c02c759697f659ba7d7f092b4f6a475971bf0291056b7
Sha512
4491f48832dfb63b726b3032e5cd813dd1b0528eca38f0e3d7ffa34690861a4bc911269264db4835bd9b925697e4d57c6ebb35449fba17ac048f169728f67684
SSDeep
393216:BvoJYnm4PaJBjPvwL4835pf/9vV0sj2UMMeEH4eMrfvh0WyFiOl:BvoJ05EtgL445ptvV0g4MAzfOl
TLSH
C20723BCB4B6B95AF5D4433BC6852CB6DB2CA540D7D93D9BCE2041927DC320E1F6A821
2 malicious · 1170 files
ZIP7e0c5b1a659c8ecee5c970cb7162d66aT1059.001CVE-2019-9674
BINbrowser
DLLdbadapt.dll
BINdefaults
BINfonts
BINgmp-clearkey
DLLpython37.dll
Structure
BINOverlay_c9a36ddd.bin
BINResources
EXESetup.exe
BINuninstall
DLLvcruntime140.dll
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
26 / 26
Path
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious
6 nodes
Path
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | http:/huhuhuhuhuhuhu |
| URL #8 | http:/huhuhuhuhuhuhu |
| URL #9 | http:/huhuhuhuhuhuhu |
| URL #10 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | http:/huhuhuhuhuhuhu |
| URL #13 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #16 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #17 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #18 | http:/huhuhuhuhuhuhu |
| URL #19 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #8 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #9 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #10 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #13 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #16 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #17 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #18 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #19 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #20 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #21 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #22 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #23 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #8 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #9 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #10 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #13 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #16 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #17 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #18 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #19 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #20 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #21 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #22 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #23 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #24 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #25 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.7 |
| CreationDate | D:20201128161048 |
| Creator | http://www.helpandmanual.com |
| ModifiedDate | D:20210218152739+03'00' |
| Title | F-Rename - Hilfesystem |
| Producer | wPDF3 by WPCubed GmbH |
| /CreationDate | D:20201128161048 |
| /Creator | http://www.helpandmanual.com |
| /ModDate | D:20210218152739+03'00' |
| /Producer | wPDF3 by WPCubed GmbH |
| /Title | F-Rename - Hilfesystem |
| Version | 1.2 |
| CreationDate | D:20260423010135 |
| Creator | http://www.helpandmanual.com |
| ModifiedDate | D:20260423010135 |
| Title | F-Rename - Hilfesystem |
| Producer | wPDF3 by WPCubed GmbH |
| /Creator | http://www.helpandmanual.com |
| /Title | F-Rename - Hilfesystem |
| /CreationDate | D:20260423010135 |
| /ModDate | D:20260423010135 |
| /Producer | wPDF3 by WPCubed GmbH |
| Version | 1.2 |
| CreationDate | D:20260423010058 |
| Creator | http://www.helpandmanual.com |
| ModifiedDate | D:20260423010058 |
| Title | F-Rename - Hilfesystem |
| Producer | wPDF3 by WPCubed GmbH |
| /Creator | http://www.helpandmanual.com |
| /Title | F-Rename - Hilfesystem |
| /CreationDate | D:20260423010058 |
| /ModDate | D:20260423010058 |
| /Producer | wPDF3 by WPCubed GmbH |
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential