Suspicious
Suspect

afe5aba808e6600b580a0aecabe5d575

ZIP Archive
MD5: afe5aba808e6600b580a0aecabe5d575
Size: 525.57 KB
application/zip

This sample is a 513.3 KB ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 4 embedded or derived files. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
1eae0bc31a3ed103b0de742b42473c046e9c2f4a7b06590001e2c7497e7871da
MD5
afe5aba808e6600b580a0aecabe5d575
Verdict
Inconclusive
File type
ZIP Archive · 513.3 KB

Cite this report: https://app.malva.re/sha256/1eae0bc31a3ed103b0de742b42473c046e9c2f4a7b06590001e2c7497e7871da

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
525.57 KB · 525,573 B
First seen
2026-10-21 14:16 · 6 days ago
Last seen
2026-10-21 14:16 · 6 days ago
Last analysis
2026-10-21 14:16 · 6 days ago
Hashes
MD5 afe5aba808e6600b580a0aecabe5d575 Sha1 4f7f71c522228e915af875b9dd8154604c91d12b Sha256 1eae0bc31a3ed103b0de742b42473c046e9c2f4a7b06590001e2c7497e7871da Sha384 714bcdd42ba2dc40d91fb84fd336c270f649fe170bb0647e997a5c083fdf484e11682ec97064fc5bf0d6525fd71e59ae Sha512 2a3a5c3d0d921ec30e9de929a6483794d4ecdf88a7ba17af610af5d49511ea0eed93d69895ef93e13f111f9caacf8b092d273b9ff5d530a17a2f881ebc8440cb SSDeep 12288:JTibgSMFBOBSlqrPKu7FxPbzJTVBU+8JM9hAC8Z36VOBRkbKQDiUbpKs:gcSMFYFKkxpTKJM9mCw36VOMWAPbpr TLSH 24B4231AF4D078CFD68ACDA394292C785F6C96C9CD126B7247C4EE9312442F627A44FE

5 files
ZIPafe5aba808e6600b580a0aecabe5d575
CMDLaunchTool.cmd
TXTlib_bit.txt
DLLlua51.dll
Structure
EXEvm_s390x.exe
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:dll
Shape arc:zip>pe:dll
2 nodes
Path arc:zip>pe:exe
Shape arc:zip>pe:exe
2 nodes

5 files
ZIPafe5aba808e6600b580a0aecabe5d575
CMDLaunchTool.cmd
TXTlib_bit.txt
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙