Suspicious
Suspect

85e951b2a1083c09cbfccba502475b5e

ZIP Archive
MD5: 85e951b2a1083c09cbfccba502475b5e
Size: 20.65 MB
application/zip

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 85e951b2a1083c09cbfccba502475b5e
Sha1 c6618e97d0abffafdb7b25016c7a606ce98803de
Sha256 2d2fdfc7b1dd18dfa690ca08b5e738ed3760866d5be2109915c4445502eedd21
Sha384 f0422450fba80ade38c5648d8aa7c79744d27265fd4e507adfacb9292ab7b5c69199be26e887b5e4e55665d25933f56b
Sha512 55cdffcbd733510006073a66268ce8d590e12d3348a650c0b5db06e99a9787ce79e828a1a517ad61e0d939c60b6dd20b00c0dcc86079496f1dacdad21a8ad989
SSDeep 393216:DMJcekzNN0E5zv9lJEzqptKaozPo8Qo/Eal25mjNVPcvO1bG6lPqa+nANkLq:DMWp7hgeMaozPo5mEal2Y0v+6eF+K
TLSH 02273355CC0574CB875B14FF4767622A4A683CB0A10BB852C2BE4D2727AB7BBE1B714C
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
RT_CURSOR
ID:0001
ID:1033
RT_DIALOG
ID:0066
ID:1037
ID:0070
ID:1037
RT_GROUP_CURSOR2
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1037
RT_MANIFEST
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
[Base64-Block@0x015260B7]
[Base64-Block-Decoded]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 2secondary ignored: 2
bin 1img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:exe>enc:b64
Shape arc:zip>pe:exe>enc:b64
3 nodes
Path arc:zip>pe:exe>html
Shape arc:zip>pe:exe>html
3 nodes
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
RT_CURSOR
ID:0001
ID:1033
RT_DIALOG
ID:0066
ID:1037
ID:0070
ID:1037
RT_GROUP_CURSOR2
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1037
RT_MANIFEST
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
[Base64-Block@0x015260B7]
[Base64-Block-Decoded]
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙