Malicious
ZIP Archive
MD5: d280afbaeaf79e2d04dcd11950acb0f2
Size: 26.97 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
26.97 MB · 26,967,831 B
First seen
2026-09-04 10:45 · one month ago
Last seen
2026-09-04 10:45 · one month ago
Last analysis
2026-09-04 10:49 · one month ago
Hashes
MD5
d280afbaeaf79e2d04dcd11950acb0f2
Sha1
405823dc041dc92ee28da721f21e387d3a6067a0
Sha256
cb263dbd6d073ea665adb55388be1bf00d335af12a8c12c49a38281b22d0d0f5
Sha384
8a3729ffad07d570056f9aaa6b1b7f67f094a3454499387eab998b08b4f35f15e1e9f508a300ac601587cfa3da1dcf62
Sha512
fc6bd40bd8fa6f1cb7dd0f1fd02e2e2e63c7b452cf9aef1a71cd5cfee1b7487cbd21aaed43370701397ab98e0483d100ce56f1ed57e4dc643cf939af62c92a26
SSDeep
786432:S1FXWiL4AWiLMnlXWHZZxkejCu01EqWiLaTzqqrOh:S1cn1nleZIc01+brY
TLSH
9E47330715E64FD4E95E8939D0E72303315CAE6A8106A39ED77DC32B3FF36A48E18199
3 malicious · 840 files
ZIPd280afbaeaf79e2d04dcd11950acb0f2T1059.005 · T1059.007CVE-2019-9674
BINlic
DLLmfc110.dll
DLLpython37.dll
Structure
BINOverlay_90cc08de.bin
BINResources
EXESetup.exe
DLLvcruntime140.dll
BINdoc
BINinfo
DLLAdvanceBackup.dll
VBSunins000.datT1059.005
VBSunins000.exe
MSGunins000.msg
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
19 / 19
Path
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious
6 nodes
Path
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
Shape
arc:zip>pe:exe>pe:rsrc>pe:exe>pe:rsrc>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.4 |
| Author | Flexense Ltd. |
| CreationDate | D:20260204125540+02'00' |
| Creator | PDFCreator Version 1.2.3 |
| Keywords | DiskPulse, Disk Change Monitor |
| ModifiedDate | D:20260204125540+02'00' |
| Subject | DiskPulse Disk Change Monitor |
| Title | DiskPulse Disk Change Monitor |
| Producer | GPL Ghostscript 9.04 |
| /Producer | GPL Ghostscript 9.04 |
| /CreationDate | D:20260204125540+02'00' |
| /ModDate | D:20260204125540+02'00' |
| /Title | DiskPulse Disk Change Monitor |
| /Creator | PDFCreator Version 1.2.3 |
| /Author | Flexense Ltd. |
| /Keywords | DiskPulse, Disk Change Monitor |
| /Subject | DiskPulse Disk Change Monitor |
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential