Suspicious
Suspect

901dbfe93052923941710db3aab0bb05

ZIP Archive
MD5: 901dbfe93052923941710db3aab0bb05
Size: 493.75 KB
application/zip

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 901dbfe93052923941710db3aab0bb05
Sha1 f35ef50518ceaed7b7a4aea8e30d6a5ac9e016ab
Sha256 d289a3b576befcd666e600f0f9022efd829062ea88a5f306ce7376f92e60acc5
Sha384 5fefd5efd327d59a218c09d1c344488e405b82d538181c498cd3aca96995bfa4d0e49c90cc3e2b013b86188d45c2d8c0
Sha512 004637dcae5055bef08e0c0ef381bf4c27a14368bcefc32e370f34b430bebffc3c33cf0b906e174a04c6c772537ff1e1459c2d718a6891f7e36af5f08f54fe55
SSDeep 12288:Xkmht7DrvdyibCCH1oHF9nJ/qjuyogoJrrzTPwkp:XkmHzMsH1ELnKogoJnn9
TLSH 20B423F193429E0B23A4DAB457A3DB3375CE7292769D9301CA06CA9F4C7072886DC16F
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
StartApp.bat
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:dll
Shape arc:zip>pe:dll
2 nodes
Path arc:zip>pe:exe
Shape arc:zip>pe:exe
2 nodes
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
StartApp.bat
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙