Malicious
Malicious

a1d1b0de333949acc2cdf55f676ddee9

ZIP Archive
MD5: a1d1b0de333949acc2cdf55f676ddee9
Size: 595 B
application/zip

This sample is a 595 bytes ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
5ee2c66ec84a66b81fbc696f615342a578d4fa3f0de3496e01555e5111eb89b2
MD5
a1d1b0de333949acc2cdf55f676ddee9
Verdict
Malicious
File type
ZIP Archive · 595 bytes
Category
LOLBin

Cite this report: https://app.malva.re/sha256/5ee2c66ec84a66b81fbc696f615342a578d4fa3f0de3496e01555e5111eb89b2

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
595 B · 595 B
First seen
2026-08-03 11:58 · 2 months ago
Last seen
2026-08-03 11:58 · 2 months ago
Last analysis
2026-08-03 11:58 · 2 months ago
Hashes
MD5 a1d1b0de333949acc2cdf55f676ddee9 Sha1 e97fb4b9512d075a46d76452b622fabb621959dd Sha256 5ee2c66ec84a66b81fbc696f615342a578d4fa3f0de3496e01555e5111eb89b2 Sha384 6c0aee6066405f33e67e3ee129f1b2959e07d33f1919fcffab75c245afe4f135f36f1c661e15beded0d727ec15a06d9d Sha512 fe4f7a58c7ab782f783d652fdd4d6eb7225249939761e72e91c101f337e4c352a664402591d530516905e01b405eccce210c13f74d4d84c148c171b242ff0643 SSDeep 12:5jScGvXV5m2fAOES6X071bjHagP/HwmwIBZ6CN0Df8BpD9Q7c/OaW:9ScGf641PW071n6wQmwIBZ6A0dc/8 TLSH 89F0E1F6B9A41168D65E54F720B9993E163C83467396630F51EEE6131C420DD89CC3D4

3 malicious · 3 files
ZIPa1d1b0de333949acc2cdf55f676ddee9LOLBin
LNKLeXNET-DOC-7OK2SF.lnkLOLBin
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.003~T1202~T1204.002
Shape arc:zip>lnk
malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 3 files
ZIPa1d1b0de333949acc2cdf55f676ddee9LOLBin
LNKLeXNET-DOC-7OK2SF.lnkLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
a1d1b0de333949acc2cdf55f676ddee9 › LeXNET-DOC-7OK2SF.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙