Suspicious
Suspect

c3cec70c65f28d3ecfd075af7ed0cdc0

ZIP Archive
MD5: c3cec70c65f28d3ecfd075af7ed0cdc0
Size: 5.91 MB
application/zip

This sample is a 5.6 MB ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 27 embedded or derived files. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352
MD5
c3cec70c65f28d3ecfd075af7ed0cdc0
Verdict
Inconclusive
File type
ZIP Archive · 5.6 MB

Cite this report: https://app.malva.re/sha256/031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
5.91 MB · 5,911,511 B
First seen
2026-07-27 04:45 · 3 months ago
Last seen
2026-07-27 04:45 · 3 months ago
Last analysis
2026-07-27 04:46 · 3 months ago
Hashes
MD5 c3cec70c65f28d3ecfd075af7ed0cdc0 Sha1 8a34ab30c6c4cc2c0e58c5765a78816628c81ce9 Sha256 031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352 Sha384 4fec675280a61f7ab70b5c7f8e238ac2f44063a2b2303c4190627383ddd867a734d47e0ffe080d4c8df6cc487b239330 Sha512 1c7c623e0110d2d70212f654b69602b7434e87b15fc4a5296c58cebb2a4ecdda924cea0138d8024789349473594a629ad33d1b5e558bcd667c80c540fcb99b7f SSDeep 98304:vK0aBfy4p26C5DEWiKQdjl6zFqRuSh9csTNw4bY6mSU6oIBYTb1Zu4z5zLh3ruJr:YjbCxETKQd3RDh9jTu40FTTbXugbud TLSH 7A563342C478C5A8F195F87EAD6E94A8FA592101EC671FBF1F2502600C9F8C9F729678

28 files
ZIPc3cec70c65f28d3ecfd075af7ed0cdc0
DLLmsvcp140.dll
Structure
P7B[Authenticode]_c434e7f7.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLucrtbase.dll
Structure
P7B[Authenticode]_c7070076.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcruntime140.dll
Structure
P7B[Authenticode]_add9f1e3.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcruntime140_1.dll
Structure
P7B[Authenticode]_2441bb51.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLzlib1.dll
Structure
BINOverlay_4febcecc.bin
EXEgit.exe
Structure
P7B[Authenticode]_20799bb1.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
DLLlibiconv-2.dll
Structure
BINOverlay_195c1fcd.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibintl-8.dll
Structure
BINOverlay_52a256d4.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibpcre2-8-0.dll
Structure
BINOverlay_8be199ad.bin
DLLlibwinpthread-1.dll
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 5 STICH kept: 1secondary ignored: 4
bin 4

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:dll
Shape arc:zip>pe:dll
2 nodes

28 files
ZIPc3cec70c65f28d3ecfd075af7ed0cdc0
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙