Malicious
ZIP Archive
MD5: 9648b44d2e16e588e27daf5e0dcc4e3a
Size: 12.9 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 9648b44d2e16e588e27daf5e0dcc4e3a |
| Sha1 | 89ca5dc874b530c4c3a8bdb0ad3ca54fac109efa |
| Sha256 | 75442883389d98c60504f7b837d4fae3734b8f296b62139aad3e1a77d4d08a8b |
| Sha384 | ede2791b8f45af7bbf9205fc11f8a49ac779d3078cb09c4f5b7bb30365d009e51325afb60b09e3ded84e2846b91abd50 |
| Sha512 | f396f4c094b9c7c131ffb7c64e9914bad2ecb53d899973af82706ee78384ddf6004dda650e4b6b89e100bb750468ad7bcc80ae15f0d204a3b8a3850b2065842b |
| SSDeep | 393216:G1diOHW2qt1xE3omIojEEDGBCevc4DJ+M0CFEj2:mi/Ri3ocErCeJ+eEK |
| TLSH | 98D6330CE6A8B10EF177799F49386BF15CDB75638CD26A481E4A23C517C0CD36F6A826 |
Malicious
Malicious
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 18
STICH kept: 6secondary ignored: 12
bin
11img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
6 / 6
Path
arc:zip>lnk~T1059.003~T1202~T1204.002~T1218
Shape
arc:zip>lnk
malicious
2 nodes
Path
arc:zip>scr:ps1~T1027~T1059.001
Shape
arc:zip>scr:ps1
malicious
2 nodes
| Name | Value |
|---|---|
| Version | 1.6 |
| CreationDate | D:20260624094352Z |
| Creator | |
| ModifiedDate | D:20260624054947-04'00' |
| Title | ION Asset Management Ltd | AUM 13F |
| Producer | Skia/PDF m149 |
| /CreationDate | D:20260624094352Z |
| /Creator | |
| /ModDate | D:20260624054947-04'00' |
| /Producer | Skia/PDF m149 |
| /Title | ION Asset Management Ltd | AUM 13F |
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$ws =huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #1
UNKNWOWNmalicious
mshuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhu
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential