Suspicious
Suspect

b9ec480432d5f25b8ee94f791e140a95

Share on LinkedIn
Print
ZIP Archive
MD5: b9ec480432d5f25b8ee94f791e140a95
Size: 71.52 KB
application/zip

This sample is a 69.8 KB ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 10 embedded or derived files. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
69b4b984cfbe5bdfae6a4c40f3b9d890619661cb61c9f7b90850335c2d4d4eed
MD5
b9ec480432d5f25b8ee94f791e140a95
Verdict
Inconclusive
File type
ZIP Archive · 69.8 KB

Cite this report: https://app.malva.re/sha256/69b4b984cfbe5bdfae6a4c40f3b9d890619661cb61c9f7b90850335c2d4d4eed

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
71.52 KB · 71,524 B
First seen
2026-09-05 16:15 · one month ago
Last seen
2026-09-05 16:15 · one month ago
Last analysis
2026-09-05 16:15 · one month ago
Hashes
MD5 b9ec480432d5f25b8ee94f791e140a95 Sha1 f6c9175e484657c44038a404709e3867af0d8a73 Sha256 69b4b984cfbe5bdfae6a4c40f3b9d890619661cb61c9f7b90850335c2d4d4eed Sha384 087e088c227b480eea44a1be85a4cb8e2671cb539d87043a035dc199d134306b15f450925c9cc6c8159cd7692d43b523 Sha512 1614a9b71125ce80b6c3012ac56ac0168aabf491a814bbaac86a81486b3826c0bc74ed5e23ce95aad4bd757963aa9d6e69578dfd925eb457c20a34185738f003 SSDeep 1536:VNnSAPg8DdHXdnSYVh2lY1OZxMGyWYVpM1rmK90ep6kDhkd:GAY8D1tn72BrMDY1rr0eQ0kd TLSH 516302859E56A512E74C3CAECFE7E301F6159A30DBC20699A972F74C45EE09D343728C

11 files
ZIPb9ec480432d5f25b8ee94f791e140a95
BAT1.bat
DLL1.dll
DLL2.dll
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3
bin 3

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:dll
Shape arc:zip>pe:dll
2 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙