Malicious
ZIP Archive
MD5: d6b2e1826c596ec94e96a2f5a4c80868
Size: 266.52 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
266.52 KB · 266,522 B
First seen
2026-07-20 11:30 · 3 months ago
Last seen
2026-07-20 11:30 · 3 months ago
Last analysis
2026-07-20 16:56 · 3 months ago
Hashes
MD5
d6b2e1826c596ec94e96a2f5a4c80868
Sha1
c8165b39e83431daa32f57d73c0f6388fbbcdbef
Sha256
1849dd8e732e4e70410b48d598b7995f7af8d0935e4a85fe10928292daaaa41a
Sha384
1a0fa7632848cce663ec12ed0cd822bf9f7e6c11985f3bb7ecfcb49556bb7eeacd1e4c6c16deebda8057550929ea7151
Sha512
f3ee754433512695bddcfc59ac4fd74f274f34a22587b1a10b777764f49d38cfb6e6d219e64497687b71c5453d795117db5e62a85c5ebc09f621528e7f8f2a7e
SSDeep
96:d2Sy1YcUbAfC0Z6gy+HURIhydy+njym08uQ:d2GcIAfC0ZGWbc+m08/
TLSH
3C44ED3075E81159E6F3EF716CF47BC69EABF5736531129A5842030A4D02E80EE65B3B
7 malicious · 7 files
ZIPd6b2e1826c596ec94e96a2f5a4c80868T1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
LNKProgramme.odt.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
LNKinvitation.rtf.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
LNKform_c.docx.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.003~T1202~T1204.002
Shape
arc:zip>lnk
malicious
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential