Malicious ZIP Archive analysis – d7b63de51041

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

5 malicious · 83 files

ZIPd7b63de51041c7cb8600118583d67c0e

OFFfatura_pendente.msi

BINRoot Entry

BIN䡀㲞䈝䗻

BIN䡀䌋䄱䜵

BIN䡀䌍䏤䊲

BIN䡀䕎䒵䠵

BIN䌋䄱䜵㷾䚨

BIN䌋䄱䜵㾾䠳

BIN䡀㬿䏲䐸䖱

BIN䡀㽿䅤䈯䠶

BIN䡀䈏䗤䕸䠨

BIN䡀䈛䌪䗶䜵

BIN䡀䋌䆨㫮䛲

BIN䡀䒌䗱䒵䠯

BIN䡀䓞䕪䇤䠨

BIN䡀䕙䓲䕨䜷

BIN䌋䄱䜵䌾䉱䠲

BIN䡀䆊䌷䑲䈝䗻

BIN䡀䈝䗻䗜䏼䠨

BIN䡀䌍䈵䗦䕲䠼

BIN䡀䒌䓰䑲䑨䠷

IMG䌋䄱䜵䅾䑤䈱䠵

IMG䌋䄱䜵䇾䄬䒯䠪

BIN䌋䄱䜵䗾䅤䄥䎦

PS1䡀㼿䕷䑬㭪䗤䠤

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

BIN䡀㼿䕷䑬㹪䒲䠯

BIN䡀㿿䏤䇬䗤䒬䠱

BIN䡀䄛䌧㫲䗸䒷䠱

BIN䡀䒌䗱䒵㮯䈹䗱

BIN䡀䘌䗶䐲䆊䌷䑲

BIN䡀䙎䑨㶷䓤䌳䊱

BIN䌋䄱䜵䆾䐲䏳䗨䠬

BIN䌋䄱䜵䆾䖸䌷䒦䠱

BIN䌋䄱䜵䈾䆻䄯䌰䠦

BIN䌋䄱䜵䌾䖱䌷䒦䠱

BIN䌋䄱䜵䕾䐨䙲䆬䠲

BIN䌋䄱䜵䕾䓨䌤䌵䠦

BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱

BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨

BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲

EXE䌋䄱䜵䄾䆬䖸䄷䗦䇾䏯

BIN䌋䄱䜵䆾䇰䌯䎱䕤䒵䠺

BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶

BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨

BIN䌋䄱䜵䉾䄵䈰䏿䉨䞷䐥䠳

BIN䌋䄱䜵䉾䄵䈰䕿䊬䗫䅾䓰

BIN䌋䄱䜵䖾䖼䐿䑬䋿䗲䅾䓰

BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦

BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨

BIN䌋䄱䜵䉾䄵䈰䆿䓤䌷䑲䅾䓰

BIN䌋䄱䜵䉾䄵䈰䗿䓲䐿䇬䅾䓰

BIN䌋䄱䜵䖾䖼䆿䒯䈶䋿䗲䅾䓰

BIN䌋䄱䜵䖾䖼䐿䑬䇿䚲䞱䐥䠳

BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦

BIN䌋䄱䜵䉾䄵䈰䗿䓲䏿䉨䞷䐥䠳

BIN䌋䄱䜵䉾䄵䈰䗿䓲䕿䊬䗫䅾䓰

BIN䌋䄱䜵䖾䖼䆿䒯䈶䇿䚲䞱䐥䠳

BIN䌋䄱䜵䖾䖼䐿䑬䑿䕲䄰䞯䐥䠳

BIN䌋䄱䜵䉾䄵䈰䅿䗲䒷䟰䈯䗩䅾䓰

BIN䌋䄱䜵䉾䄵䈰䅿䗲䒷䟰䌰䞧䐥䠳

BIN䌋䄱䜵䖾䖼䆿䒯䈶䑿䕲䄰䞯䐥䠳

BIN䌋䄱䜵䖾䖼䐿䑬䌿䄱䗦䙬䞨䐥䠳

BIN䌋䄱䜵䉾䄵䈰䅿䗲䒷䟰䌵䋪䞷䐥䠳

BIN䌋䄱䜵䉾䄵䈰䏿䉨䟷䑬䆤䌷䈹䅾䓰

BIN䌋䄱䜵䖾䖼䆿䒯䈶䌿䄱䗦䙬䞨䐥䠳

BIN䌋䄱䜵䉾䄵䈰䕿䊬䗫䌿䄱䗦䙬䞨䐥䠳

BIN䌋䄱䜵䉾䄵䈰䆿䓤䌷䑲䌿䄱䗦䙬䞨䐥䠳

BIN䌋䄱䜵䉾䄵䈰䗿䓲䏿䉨䟷䑬䆤䌷䈹䅾䓰

BIN䌋䄱䜵䉾䄵䈰䗿䓲䐿䇬䌿䄱䗦䙬䞨䐥䠳

EXE䌋䄱䜵㹾䚲䕨䋜䏨㼯䕦䓬㵷䘤䆱䈫䞵䏧䠯

BIN䌋䄱䜵䉾䄵䈰䅿䗲䒷䟰䌰䟧䑬䆤䌷䈹䅾䓰

BIN䌋䄱䜵䉾䄵䈰䗿䓲䕿䊬䗫䌿䄱䗦䙬䞨䐥䠳

BINSummaryInformation

BIN䌋䄱䜵䉾䄵䈰䅿䗲䒷䟰䈯䗩䌿䄱䗦䙬䞨䐥䠳

BIN䌋䄱䜵䉾䄵䈰䅿䗲䒷䟰䌵䋪䟷䑬䆤䌷䈹䅾䓰

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #13 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Brahuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Brahuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential