Suspicious
Suspect

ccf09db51116bca16021742b197b064f

Share on LinkedIn
Print
ZIP Archive
MD5: ccf09db51116bca16021742b197b064f
Size: 493.75 KB
application/zip

This sample is a 482.2 KB ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 4 embedded or derived files. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
41ddcb59f85e7de29cb2c96f97907feed7691734a44ad100be090ce29a40f196
MD5
ccf09db51116bca16021742b197b064f
Verdict
Inconclusive
File type
ZIP Archive · 482.2 KB

Cite this report: https://app.malva.re/sha256/41ddcb59f85e7de29cb2c96f97907feed7691734a44ad100be090ce29a40f196

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
493.75 KB · 493,748 B
First seen
2026-10-21 14:16 · 12 days ago
Last seen
2026-10-21 14:16 · 12 days ago
Last analysis
2026-10-21 14:16 · 12 days ago
Hashes
MD5 ccf09db51116bca16021742b197b064f Sha1 406183694822caaa90e95070d2ac414b810e40c4 Sha256 41ddcb59f85e7de29cb2c96f97907feed7691734a44ad100be090ce29a40f196 Sha384 bcef3ec172479775d4190caafdb1388d6d7afc2fb5477ea33fcbe1938d84d164d4558286e45f925e6915c33f8cefa730 Sha512 64f74d8b4489708b5dcad45b31974be81dc19263c94cb6e8559cd1382036cc9b34c963cebe4f6fc90b633cd8a2f02f001354bc49934df233b093c7dbb4357078 SSDeep 12288:0kmht7DrvdyiICCH1oHF9nJ/qjuyLgoJrrzTPwke:0kmHzM9H1ELnKLgoJnnC TLSH 10B423F193429E0B23A4DAB457A3DB3375CE7292769D9311CA06CA9F4C7072886DC16F

5 files
ZIPccf09db51116bca16021742b197b064f
TXTasm.txt
BATStartApp.bat
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>pe:dll
Shape arc:zip>pe:dll
2 nodes
Path arc:zip>pe:exe
Shape arc:zip>pe:exe
2 nodes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙