Malicious
ZIP Archive
MD5: d1f009e2fd65b43f2eb917a772fbb8d6
Size: 2.54 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
2.54 KB · 2,540 B
First seen
2025-02-16 01:00 · one year ago
Last seen
2025-02-16 01:00 · one year ago
Last analysis
2025-02-16 01:01 · one year ago
Hashes
MD5
d1f009e2fd65b43f2eb917a772fbb8d6
Sha1
bcdc298cdd7eba27cfad2f824860f94faadf9e24
Sha256
329ae4035bda94f3994dfc78d2bd771647e05cde4fe091ed076cea12f5831b81
Sha384
1f7f2fc25d5af3e7417aa70b4ebe7cd097e04ecfe85a4a131516c3e13cdd249727e268ee345e223cf6cb3e763b927f9e
Sha512
158a273d4278dc03e4f48dd570ccc3cf462f03b0370d3f6d05445472f1c75b690d74291357efbab5c1e9bb8ac7c124b017c71c89c2902150853a10699e9c1c56
SSDeep
48:9iywvVA1zu7+TuSS8kWZTaWnywvVA1zu7+TuSS8kWZTaWU:YZvVA1K7+TuSSETaeZvVA1K7+TuSSET8
TLSH
B351D7A0740F6D74ED8AA7BE6088E8A92C4560CC6E65FF18A0C1EE55695634807B835A
10 malicious · 11 files
ZIPPayment Swift copy.zipT1059.001 · T1059.003 · T1204.002LOLBin
LNKDetails of Transaction.lnkT1059.001 · T1059.003 · T1204.002LOLBin
SHLNK CommandLine
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-noninhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential10 malicious · 11 files
ZIPPayment Swift copy.zipT1059.001 · T1059.003 · T1204.002LOLBin
LNKDetails of Transaction.lnkT1059.001 · T1059.003 · T1204.002LOLBin
SHLNK CommandLine
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Payment Swift copy.zip › Details of Transaction.lnk
Deobfuscated PowerShell
UNKNWOWNmalicious
-noninhuhuhuhuhuhuhuhuhuhuhu
Payment Swift copy.zip › Details of Transaction.lnk › LNK CommandLine
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Payment Swift copy.zip › Details of Transaction.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account