Malicious
Malicious

ac1d2f0a1b59c35ad98f1c955492e396

ZIP Archive
MD5: ac1d2f0a1b59c35ad98f1c955492e396
Size: 578 B
application/zip

This sample is a 578 bytes ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
1b5319091a4a8e5404880ce32c117531fc9a6407bb1156246499e6392e635746
MD5
ac1d2f0a1b59c35ad98f1c955492e396
Verdict
Malicious
File type
ZIP Archive · 578 bytes
Category
LOLBin

Cite this report: https://app.malva.re/sha256/1b5319091a4a8e5404880ce32c117531fc9a6407bb1156246499e6392e635746

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
578 B · 578 B
First seen
2026-08-03 13:02 · 2 months ago
Last seen
2026-08-03 13:02 · 2 months ago
Last analysis
2026-08-03 13:02 · 2 months ago
Hashes
MD5 ac1d2f0a1b59c35ad98f1c955492e396 Sha1 fcb91f17b8c51c7f0e256a78672e965495ed785f Sha256 1b5319091a4a8e5404880ce32c117531fc9a6407bb1156246499e6392e635746 Sha384 0e80099dd2c61279d4bc6c2b0ddbbbcddb8c11a0e1c5c7429a4ae0947cd30f622fa5342303fb257322288f9e781026f7 Sha512 0aabbee6ca2f3da2d84ac83489ac1662c1493802a0c69f026a7f379b847b97340ae9b3b8f00a16b34b45df14bf0a645ea2044882725e1cd84b5c38b2fd86f304 SSDeep 12:5jIgljUlhWIaQOe41qFsN3B9rq1hq89C0mpLE1E1B06btfZtTGgljJcaou:9IgljUlRd41qFsJO1q0mjB0wtfnGgljL TLSH EFF02003C17542AAF05AB0BA91216EA439348975231B2FDCA6DCD0CD3CDAB81DFA94D1

3 malicious · 3 files
ZIPac1d2f0a1b59c35ad98f1c955492e396LOLBin
LNKDOC-5ZNWE9.lnkLOLBin
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.003~T1202~T1204.002
Shape arc:zip>lnk
malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 3 files
ZIPac1d2f0a1b59c35ad98f1c955492e396LOLBin
LNKDOC-5ZNWE9.lnkLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
ac1d2f0a1b59c35ad98f1c955492e396 › DOC-5ZNWE9.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙