Malicious
Malicious

c27fb5af42b0c24bc6ad9bae732b1304

Share on LinkedIn
Print
ZIP Archive
MD5: c27fb5af42b0c24bc6ad9bae732b1304
Size: 593 B
application/zip
Ctrl + scroll to zoom · drag to pan

This sample is a 593 bytes ZIP Archive classified as malicious by Malva.RE (lolbin). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d42ddc4334652e0eca85d541bdf6fe2c795a917de3819daa4757ce25e950dcb5
MD5
c27fb5af42b0c24bc6ad9bae732b1304
Verdict
Malicious
File type
ZIP Archive · 593 bytes
Category
LOLBin

Cite this report: https://app.malva.re/sha256/d42ddc4334652e0eca85d541bdf6fe2c795a917de3819daa4757ce25e950dcb5

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
593 B · 593 B
First seen
2026-08-03 11:01 · 2 months ago
Last seen
2026-08-03 11:01 · 2 months ago
Last analysis
2026-08-03 11:01 · 2 months ago
Hashes
MD5 c27fb5af42b0c24bc6ad9bae732b1304 Sha1 056578f6cccdae2e9ab2a4c00e7369c3c313a430 Sha256 d42ddc4334652e0eca85d541bdf6fe2c795a917de3819daa4757ce25e950dcb5 Sha384 a559f18e1fa9a6d51d43ffbe7c69eba5ead302336ccae0c1301064ceefe17af586b26b1eb54104ec30404e78ea891590 Sha512 b0ab33fe0594a7eb90451447da6c32c60635f5bee8936b8cfd20457d95ceac326d0de5570b8f34c81b3b509921c107c50c0b07be535ceb8221713a7d99679209 SSDeep 12:5j3JlZDimE/pRSp1tcKnjMRitbQqrwLEu8MsAMkHGnFHaof:9vADwtrYYtsqrcI/JFpf TLSH FDF041E30B4A3030C382477428229A7E2459F385E40A294EEEABDE5438E60980519068

3 malicious · 3 files
ZIPc27fb5af42b0c24bc6ad9bae732b1304LOLBin
LNKDOC-UMVODE.lnkLOLBin
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.003~T1202~T1204.002
Shape arc:zip>lnk
malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙