Suspicious
Suspect

7ebf6224aa839f3b1926388789bcdacf

ZIP Archive
MD5: 7ebf6224aa839f3b1926388789bcdacf
Size: 531.06 KB
application/zip

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 7ebf6224aa839f3b1926388789bcdacf
Sha1 4d0d8cbe69b5e03b3e1acbe9665c78d155ebaf03
Sha256 59f859e3de41e131bf90c185e265ac8ddf423139efacab6fc32f3846d91c399b
Sha384 d43e0e0c0403896b59c8c825e1891e5f466069fafc793a424442ff7a19fa3cfbdd2984d0936b0caa7af5685d6607c54c
Sha512 1f71ee69ef793b473e66c0286282232e31fe2fb985777bcc6fb5a9eee8abf1d6cdefc3b3c04e9c9b0022cc549b2e28271dce7488252dd5cec95c45d17ed2f83d
SSDeep 12288:ayl/3BItd+3+mViRziobl9jcr91+rTY3rkC1uvq39jP6Fe952/mC50:Z1+tdI0RLbl2rKY3ICdJPF9YX0
TLSH A1B4235A2EAD7BE7CD91A05411E132682C1A89D8CA77EB059C5842F20877B14FE5F28F
Application.cmd
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:dll
Shape arc:zip>pe:dll
2 nodes
Path arc:zip>pe:exe
Shape arc:zip>pe:exe
2 nodes
Application.cmd
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙