Malicious
ZIP Archive
MD5: d7f27f225967140a8d89886ab7346618
Size: 110.06 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | d7f27f225967140a8d89886ab7346618 |
| Sha1 | 465cc40fdcb4f343d11b70e70f05697ae28be57e |
| Sha256 | d782bdd883c0a1f8c484e50765a1481116f9e700fea7dc9e39df2ab4cb9dd8a2 |
| Sha384 | 651d8ed7aee4a2aa178830982dc19654678278e7f1e2f5eee1e1c36acf1dc5e6519a08f485ab8c7c6467b605dfe7c70a |
| Sha512 | 31a9503a653b2839ec18a4f914ebaae4fabf92e5fde4d8244c3244266c8bb1b8a201cb52827641d08f8ce55b15535e8a75443607d044e664932e2118248c0cfb |
| SSDeep | 3072:sYPdx+eEvrLgAXxx6aDEbbCDx/TzFpICMyb3:sYP3UbFDAbkx/fFS7u3 |
| TLSH | 9CB312D5BC2F8560D07975BE2C9AE334621217A47B4901F52D78E3F312EBB478B62263 |
Malicious
Malicious
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1059.001~T1105>pdf>pdf:stream>bin
Shape
arc:zip>lnk>scr:ps1>pdf>pdf:stream>bin
malicious
6 nodes
Path
arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.4 |
| Author | (anonymous) |
| CreationDate | D:20260928022456+00'00' |
| Creator | (unspecified) |
| ModifiedDate | D:20260928022456+00'00' |
| Subject | (unspecified) |
| Title | (anonymous) |
| Producer | ReportLab PDF Library - (opensource) |
| /Author | (anonymous) |
| /CreationDate | D:20260928022456+00'00' |
| /Creator | (unspecified) |
| /ModDate | D:20260928022456+00'00' |
| /Producer | ReportLab PDF Library - (opensource) |
| /Subject | (unspecified) |
| /Title | (anonymous) |
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
updatehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$rukp huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential