Malicious
87c1badcfd555bca1b5fe13ed212d1b2
ZIP Archive
MD5: 87c1badcfd555bca1b5fe13ed212d1b2
Size: 27.37 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
27.37 KB · 27,372 B
First seen
2026-06-24 11:46 · 4 months ago
Last seen
2026-06-24 11:46 · 4 months ago
Last analysis
2026-06-25 15:27 · 4 months ago
Hashes
MD5
87c1badcfd555bca1b5fe13ed212d1b2
Sha1
c9b580d9811f2df1c70edc25825319d2eb29d392
Sha256
90984d6788417bc284b17c3b302c1b667acfbf881eee0afeea1141b30f7379e1
Sha384
907b70c12f49eb28d87c67c4c24ecaba564788955ba9838c0523f6405d7b650e6221a867ba9d11b48a7cc8eb5835d07c
Sha512
fa40e257d5a119c76723e6c2923d9b3b827cd334f2b0c10580764d012537314bd051fc190b2a8c85dfc7de263515cd63f51499f1bebcdfc5ceb808a0f7683a9e
SSDeep
48:ABx3NGkTvdqTel+tk051WUyauR6qxXY67QqTel+tsd51WU4csoqJ/iWEB/iIc1f:ABxZTSel+t1nJuXV77el+tGnFtjoIAf
TLSH
95C2E28173F81304F5B6FE36DE39AB45483ABA90ED31C7AC5950CC1D2A66A00EA75F35
16 malicious · 16 files
ZIP87c1badcfd555bca1b5fe13ed212d1b2T1059.001 · T1059.003 · T1059.005LOLBin
LNKVYTIaH_Nakaz_pro_rozrakhunok_vysluhy.pdf.lnkT1059.001 · T1059.003 · T1204.002LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
LNKVYTIaH_Osobova_sprava_viiskovosluzhbovtsia.pdf.lnkT1059.001 · T1059.003 · T1059.005LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]T1059.005
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary].deobfuscated.vbsT1059.005
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential16 malicious · 16 files
ZIP87c1badcfd555bca1b5fe13ed212d1b2T1059.001 · T1059.003 · T1059.005LOLBin
LNKVYTIaH_Nakaz_pro_rozrakhunok_vysluhy.pdf.lnkT1059.001 · T1059.003 · T1204.002LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
LNKVYTIaH_Osobova_sprava_viiskovosluzhbovtsia.pdf.lnkT1059.001 · T1059.003 · T1059.005LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]T1059.005
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary].deobfuscated.vbsT1059.005
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
87c1badcfd555bca1b5fe13ed212d1b2 › VYTIaH_Osobova_sprava_viiskovosluzhbovtsia.pdf.lnk
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
87c1badcfd555bca1b5fe13ed212d1b2 › VYTIaH_Osobova_sprava_viiskovosluzhbovtsia.pdf.lnk › [Lnk Summary]
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
87c1badcfd555bca1b5fe13ed212d1b2 › VYTIaH_Osobova_sprava_viiskovosluzhbovtsia.pdf.lnk › [Lnk Summary] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
87c1badcfd555bca1b5fe13ed212d1b2 › VYTIaH_Osobova_sprava_viiskovosluzhbovtsia.pdf.lnk › LNK CommandLine › [PowerShell Command]
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
87c1badcfd555bca1b5fe13ed212d1b2 › VYTIaH_Nakaz_pro_rozrakhunok_vysluhy.pdf.lnk
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
87c1badcfd555bca1b5fe13ed212d1b2 › VYTIaH_Nakaz_pro_rozrakhunok_vysluhy.pdf.lnk › [Lnk Summary]
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
87c1badcfd555bca1b5fe13ed212d1b2 › VYTIaH_Nakaz_pro_rozrakhunok_vysluhy.pdf.lnk › [Lnk Summary] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
87c1badcfd555bca1b5fe13ed212d1b2 › VYTIaH_Nakaz_pro_rozrakhunok_vysluhy.pdf.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account