Suspicious
Suspect

9916fa2376740a498a842ad354616f9b

ZIP Archive
MD5: 9916fa2376740a498a842ad354616f9b
Size: 2.82 MB
application/zip

This sample is a 2.7 MB ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 78 embedded or derived files. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
f452b1a06c86c4ffa7ae32359cd2c03e58f6f20c7f892c4819c85836085804ae
MD5
9916fa2376740a498a842ad354616f9b
Verdict
Inconclusive
File type
ZIP Archive · 2.7 MB

Cite this report: https://app.malva.re/sha256/f452b1a06c86c4ffa7ae32359cd2c03e58f6f20c7f892c4819c85836085804ae

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
2.82 MB · 2,819,462 B
First seen
2026-10-26 18:30 · 11 hours ago
Last seen
2026-10-26 18:30 · 11 hours ago
Last analysis
2026-10-26 18:30 · 11 hours ago
Hashes
MD5 9916fa2376740a498a842ad354616f9b Sha1 77906717b2de97be7074c2f3a9323fd625c497e1 Sha256 f452b1a06c86c4ffa7ae32359cd2c03e58f6f20c7f892c4819c85836085804ae Sha384 f1d6f3ce7a21e7f2250b5a26588a0432b274a644f9f610b2bbe01b849f427c79ccc7e44b5982013d854eb22f5b29bb85 Sha512 91be0826e77b6327318cbf1934b2e2ce5ced3eabb9f7dbcee43a2d23799afccbb250025e78543291b095d386fd1f3e30aeabdc37833275b4fa1aec0913c273cf SSDeep 49152:wU8C6HHyA/JvPKeQhx6jfbZ/J7/LFLlJT9AJd6Jxs0S:h2hNRYxMfXL9Ty6vs0S TLSH A5D533185DB968F0931B3C5A2FB11A4F81C3C1B23A98FBB8B29CD3095D34F66519674E

79 files
ZIP9916fa2376740a498a842ad354616f9b
DATconf.dat
DLLEraser.dll
Structure
EXEErsChk.exe
Structure
P7B[Authenticode]_eb1163f7.p7b
BINResources
BINRT_CURSOR
BINID:0003
BINID:18441
BINID:0004
BINID:18441
BINID:0005
BINID:18441
BINID:0006
BINID:18441
BINID:0007
BINID:18441
BINID:0008
BINID:18441
BINID:0009
BINID:18441
BINID:000A
BINID:18441
BINID:000B
BINID:18441
BINID:000C
BINID:18441
BINID:000D
BINID:18441
BINID:000E
BINID:18441
BINID:000F
BINID:18441
BINID:0010
BINID:18441
BINID:0011
BINID:18441
BINID:0012
BINID:18441
BINID:0013
BINID:18441
BINID:0014
BINID:18441
BINID:0015
BINID:18441
BINID:0016
BINID:18441
BINID:0017
BINID:18441
BINID:0018
BINID:18441
BINRT_BITMAP
BINID:0061
BINID:18441
BINID:0087
BINID:18441
BINID:0098
BINID:18441
BINID:009A
BINID:18441
BINID:7912
BINID:18441
BINID:7914
BINID:18441
BINRT_ICON
BINID:0001
BINID:1035
BINID:0002
BINID:1035
BINRT_MENU
BINID:0072
BINID:18441
BINRT_DIALOG
BINID:005D
BINID:18441
BINID:0066
BINID:1033
BINID:0081
BINID:1035
BINID:7801
BINID:18441
BINID:780E
BINID:18441
BINRT_STRING
BINID:0F01
BINID:18441
BINID:0F02
BINID:18441
BINID:0F03
BINID:18441
BINID:0F11
BINID:18441
BINID:0F12
BINID:18441
BINID:0F13
BINID:18441
BINID:0F14
BINID:18441
BINID:0F19
BINID:18441
BINID:0F1A
BINID:18441
BINID:0F1B
BINID:18441
BINID:0F1C
BINID:18441
BINID:0F1D
BINID:18441
BINID:0F2F
BINID:18441
BINRT_GROUP_CURSOR2
BINID:005E
BINID:18441
BINID:005F
BINID:18441
BINID:0060
BINID:18441
BINID:0082
BINID:18441
BINID:0083
BINID:18441
BINID:0084
BINID:18441
BINID:7901
BINID:18441
BINID:7916
BINID:18441
BINID:7917
BINID:18441
BINID:7918
BINID:18441
BINID:7919
BINID:18441
BINID:791A
BINID:18441
BINID:791B
BINID:18441
BINID:791C
BINID:18441
BINID:791D
BINID:18441
BINID:791E
BINID:18441
BINID:791F
BINID:18441
BINID:7920
BINID:18441
BINID:7921
BINID:18441
BINID:7922
BINID:18441
BINID:7923
BINID:18441
BINRT_GROUP_CURSOR4
BINID:0080
BINID:1035
BINRT_VERSION
BINID:0001
BINID:18441
BINRT_MANIFEST
BINID:0001
BINID:1033
BINRT_TOOLBAR
BINID:0087
BINID:18441
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3
bin 3

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:dll
Shape arc:zip>pe:dll
2 nodes

79 files
ZIP9916fa2376740a498a842ad354616f9b
DATconf.dat
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙