Malicious
99d398b4033f24971eedbc087cd4f3d0
ZIP Archive
MD5: 99d398b4033f24971eedbc087cd4f3d0
Size: 641 B
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
641 B · 641 B
First seen
2026-08-03 08:30 · 2 months ago
Last seen
2026-08-03 08:30 · 2 months ago
Last analysis
2026-08-03 08:30 · 2 months ago
Hashes
MD5
99d398b4033f24971eedbc087cd4f3d0
Sha1
819cfe3bf1333a04cb8d3ee5269443fb96c91b45
Sha256
4812f018b0f7b152e1653701c004a98e7c0328c291a925d7c14721aba10b94ee
Sha384
a09dc15fb1d82cf23c811515587b8bc97571956c956ae867105b1903cc41a37e00a58b246fcec39fdd53e9c871ae7c8c
Sha512
f38a2adf6323e4f9facee542fd07b85e84990b42438ac6030421a936067b4078ff2eb6040e8ba2d8cadc2bd3bdd17f91b0ecd7dcc1b156f951c9cae9d303990b
SSDeep
12:5jimsRiM/ncGKc7pRDMLoVubqPutCndFRcnJd+a68MqI81YnJArqsm2smBiM/ncL:9imsRi1fcjwoKqPunJdUhqI81Y2qAsmu
TLSH
87F0239E8224E121C4F6ED71208B24642E71A3AAD4B255021062A6D05138F03EF10D38
3 malicious · 3 files
ZIP99d398b4033f24971eedbc087cd4f3d0T1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
LNKContrato_Indeniza_Brasil-8BIH8D.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.003~T1202~T1204.002
Shape
arc:zip>lnk
malicious
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 3 files
ZIP99d398b4033f24971eedbc087cd4f3d0T1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
LNKContrato_Indeniza_Brasil-8BIH8D.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
99d398b4033f24971eedbc087cd4f3d0 › Contrato_Indeniza_Brasil-8BIH8D.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account