Malicious
ZIP Archive
MD5: b488ad1a2dbca55ab67785c98631ca32
Size: 59.47 KB
application/zip
Ctrl + scroll to zoom · drag to pan
This sample is a 58.1 KB ZIP Archive classified as malicious by Malva.RE. Static analysis extracted 8 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 36db9899d7cd209c5fbde5feed76a98cdf9be9702badd1e9c5a02177cd7af1c8
- MD5
- b488ad1a2dbca55ab67785c98631ca32
- Verdict
- Malicious
- File type
- ZIP Archive · 58.1 KB
Cite this report: https://app.malva.re/sha256/36db9899d7cd209c5fbde5feed76a98cdf9be9702badd1e9c5a02177cd7af1c8
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
59.47 KB · 59,466 B
First seen
2026-10-28 11:00 · 10 minutes ago
Last seen
2026-10-28 11:00 · 10 minutes ago
Last analysis
2026-10-28 11:01 · 9 minutes ago
Hashes
MD5
b488ad1a2dbca55ab67785c98631ca32
Sha1
b8c7cfb140fe8f383f7afb40ce0d5856a2be23a1
Sha256
36db9899d7cd209c5fbde5feed76a98cdf9be9702badd1e9c5a02177cd7af1c8
Sha384
bf7ed5fa0d3e2c330e8b2dd024384566b85f5c5dd0d05e0a1854c247a870097fd0061c336a1da36a45f84f5402315252
Sha512
202e371d909d4e090e467377d5095424e81859bc44d14bb34775e74496ff7bac4c6f7ca03f13e122cac1acad3c71dd118141d3c08078df4b392aa53a7dd66b02
SSDeep
1536:1b724hQ2KZGmNR323yij/+KdUlg1rEQZFxRdGK9F42rAvXd:D1KZG93h3Uy1hvRUKb4fXd
TLSH
CC43F1842AE3117117EBAC982C327A00CF34565450FE520FAA599CC063A7799E39EF6F
9 malicious · 9 files
ZIPb488ad1a2dbca55ab67785c98631ca32T1027 · T1059.001 · T1059.005
PS1Kronragede.vbsT1027 · T1059.001 · T1059.005
VBSKronragede.vbs.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
arc:zip>scr:ps1>scr:vbs>scr:ps1
malicious
4 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential