Malicious ZIP Archive analysis – 5a417f4582f9

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

Size

11.27 MB · 11,267,471 B

First seen

2026-10-16 04:30 · 9 days ago

Last seen

2026-10-16 04:30 · 9 days ago

Last analysis

2026-10-16 04:31 · 9 days ago

Hashes

MD5 bbbef4ff727315c1abc519d74f1af0a8 Sha1 6a813c5e3c77d0e37bd76584caa6c9960391f6e1 Sha256 5a417f4582f91f21f2842b170d21cf5f92b48fad39183e315d505d5a2deef5c0 Sha384 eacd25d8c4876f584d62d2ba1b9c111bfd9fb03847dc77a84e43c3edfd1c56c15c825ce0740dd3db03b88c570e3d2f52 Sha512 754096b205169a39dbe1ae386645dc3d6367979d1515a9676302e18b9fac2635ed2718cdd6615a812f9ea6d59e489499979e7efaa9f8dc185ce9e0a2a597fc1a SSDeep 196608:Ooslj+RxnaqYfoYhvhVo6PfrlPW2zvT6VpsaurXkJWcaiJ5uQdQnBhI:OflinDUh7o67QaT6vslTkJWlQdQnBi TLSH F8B633ECC6403CCDE887BA39CBE819EAE9D58A37CA10E5E6D145A3E024BE1FD1C51457

6 malicious · 808 files

ZIPbbbef4ff727315c1abc519d74f1af0a8

BINsystem

PYchannel.py

PYcipher.py

BINdata

ZIPstate.db

BIN.build_id

TXTLICENSE.txt

EXE_asyncio.pyd

EXE_bz2.pyd

EXE_ctypes.pyd

EXE_decimal.pyd

EXE_elementtree.pyd

EXE_hashlib.pyd

EXE_lzma.pyd

EXE_msi.pyd

EXE_multiprocessing.pyd

EXE_overlapped.pyd

EXE_queue.pyd

EXE_socket.pyd

EXE_sqlite3.pyd

EXE_ssl.pyd

EXE_uuid.pyd

EXE_zoneinfo.pyd

DLLlibcrypto-3.dll

DLLlibffi-8.dll

DLLlibssl-3.dll

EXEpyexpat.pyd

CATpython.cat

EXEpython.exe

DLLpython3.dll

_PTHpython311._pth

DLLpython311.dll

ZIPpython311.zip

PYCabc.pyc

PYCaifc.pyc

PYCantigravity.pyc

PYCargparse.pyc

PYCast.pyc

PYCasynchat.pyc

PYCasyncore.pyc

PYCbase64.pyc

PYCbdb.pyc

PYCbisect.pyc

PYCbz2.pyc

PYCcalendar.pyc

PYCcgi.pyc

PYCcgitb.pyc

PYCchunk.pyc

PYCcmd.pyc

PYCcode.pyc

PYCcodecs.pyc

PYCcodeop.pyc

PYCcolorsys.pyc

PYCcompileall.pyc

PYCconfigparser.pyc

PYCcontextlib.pyc

PYCcontextvars.pyc

PYCcopy.pyc

PYCcopyreg.pyc

PYCcProfile.pyc

PYCcrypt.pyc

PYCcsv.pyc

PYCdataclasses.pyc

PYCdatetime.pyc

PYCdecimal.pyc

PYCdifflib.pyc

PYCdis.pyc

PYCdoctest.pyc

PYCenum.pyc

PYCfilecmp.pyc

PYCfileinput.pyc

PYCfnmatch.pyc

PYCfractions.pyc

PYCftplib.pyc

PYCfunctools.pyc

PYCgenericpath.pyc

PYCgetopt.pyc

PYCgetpass.pyc

PYCgettext.pyc

PYCglob.pyc

PYCgraphlib.pyc

PYCgzip.pyc

PYChashlib.pyc

PYCheapq.pyc

PYChmac.pyc

PYCimaplib.pyc

PYCimghdr.pyc

PYCimp.pyc

PYCinspect.pyc

PYCio.pyc

PYCipaddress.pyc

PYCkeyword.pyc

PYClinecache.pyc

PYClocale.pyc

PYClzma.pyc

PYCmailbox.pyc

PYCmailcap.pyc

PYCmimetypes.pyc

PYCmodulefinder.pyc

PYCnetrc.pyc

PYCnntplib.pyc

PYCntpath.pyc

PYCnturl2path.pyc

PYCnumbers.pyc

PYCopcode.pyc

PYCoperator.pyc

PYCoptparse.pyc

PYCos.pyc

PYCpathlib.pyc

PYCpdb.pyc

PYCpickle.pyc

PYCpickletools.pyc

PYCpipes.pyc

PYCpkgutil.pyc

PYCplatform.pyc

PYCplistlib.pyc

PYCpoplib.pyc

PYCposixpath.pyc

PYCpprint.pyc

PYCprofile.pyc

PYCpstats.pyc

PYCpty.pyc

PYCpyclbr.pyc

PYCpydoc.pyc

PYCpy_compile.pyc

PYCqueue.pyc

PYCquopri.pyc

PYCrandom.pyc

PYCreprlib.pyc

PYCrlcompleter.pyc

PYCrunpy.pyc

PYCsched.pyc

PYCsecrets.pyc

PYCselectors.pyc

PYCshelve.pyc

PYCshlex.pyc

PYCshutil.pyc

PYCsignal.pyc

PYCsite.pyc

PYCsmtpd.pyc

PYCsmtplib.pyc

PYCsndhdr.pyc

PYCsocket.pyc

PYCsocketserver.pyc

PYCsre_compile.pyc

PYCsre_constants.pyc

PYCsre_parse.pyc

PYCssl.pyc

PYCstat.pyc

PYCstatistics.pyc

PYCstring.pyc

PYCstringprep.pyc

PYCstruct.pyc

PYCsubprocess.pyc

PYCsunau.pyc

PYCsymtable.pyc

PYCsysconfig.pyc

PYCtabnanny.pyc

PYCtarfile.pyc

PYCtelnetlib.pyc

PYCtempfile.pyc

PYCtextwrap.pyc

PYCthis.pyc

PYCthreading.pyc

PYCtimeit.pyc

PYCtoken.pyc

PYCtokenize.pyc

PYCtrace.pyc

PYCtraceback.pyc

PYCtracemalloc.pyc

PYCtty.pyc

PYCtypes.pyc

PYCtyping.pyc

PYCuu.pyc

PYCuuid.pyc

PYCwarnings.pyc

PYCwave.pyc

PYCweakref.pyc

PYCwebbrowser.pyc

PYCxdrlib.pyc

PYCzipapp.pyc

PYCzipfile.pyc

PYCzipimport.pyc

PYC_aix_support.pyc

PYC_bootsubprocess.pyc

PYC_collections_abc.pyc

PYC_compat_pickle.pyc

PYC_compression.pyc

PYC_markupbase.pyc

PYC_osx_support.pyc

PYC_pydecimal.pyc

PYC_pyio.pyc

PYC_py_abc.pyc

PYC_sitebuiltins.pyc

PYC_strptime.pyc

PYC_threading_local.pyc

PYC_weakrefset.pyc

PYC__future__.pyc

PYC__hello__.pyc

BINasyncio

BINcollections

BINconcurrent

BINctypes

BINcurses

BINdbm

BINdistutils

BINemail

BINencodings

BINhtml

BINhttp

BINimportlib

BINjson

BINlib2to3

BINlogging

BINmsilib

BINmultiprocessing

BINpydoc_data

VBStopics.pyc

CSS_pydoc.css

PYC__init__.pyc

BINre

BINsite-packages

BINsqlite3

BINtomllib

BINunittest

BINurllib

BINwsgiref

BINxml

BINxmlrpc

BINzoneinfo

BIN__phello__

EXEpythonw.exe

EXEselect.pyd

DLLsqlite3.dll

EXEunicodedata.pyd

DLLvcruntime140.dll

DLLvcruntime140_1.dll

EXEwinsound.pyd

PYexecutor.py

PYhost.py

PYui.py

PS1__init__.py

BIN__pycache__

BIN.gitignore

PYbot_actions.py

JSONconfig.json

PYconfig.py

PYmain.py

TXTrequirements.txt

PS1run.bat

PS1[Deobfuscated PS]

SHrun.sh

BIN__pycache__

BINactions

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 5secondary ignored: 8

bin 7img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

5 / 5

Path arc:zip>scr:ps1~T1027~T1059.001

Shape arc:zip>scr:ps1

malicious 2 nodes

Path arc:zip>arc:zip>arc:zip>scr:vbs~T1059.005

Shape arc:zip>arc:zip>arc:zip>scr:vbs

technique4 nodes

Deobfuscated PowerShell UNKNWOWNmalicious

@echo huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential