Suspicious
Suspect

de1ed40a5ee058ead6d0c4525977e7ce

ZIP Archive
MD5: de1ed40a5ee058ead6d0c4525977e7ce
Size: 182.37 KB
application/zip

This sample is a 178.1 KB ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 22 embedded or derived files. It matches 3 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4
MD5
de1ed40a5ee058ead6d0c4525977e7ce
Verdict
Inconclusive
File type
ZIP Archive · 178.1 KB

Cite this report: https://app.malva.re/sha256/c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
182.37 KB · 182,373 B
Hashes
MD5 de1ed40a5ee058ead6d0c4525977e7ce Sha1 7b9c04dfae43a2b5d7da408caf65049c5221f98f Sha256 c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4 Sha384 3cc3b1fd691d5bc0fc29c40174f329a7bf4f6a9233128c3bac2264da4420f15cc5518f553f11f415a524dab64a55b585 Sha512 c57f8452a0ff2c4e8470d3624444272db36edfa77a5279b2be17ac1b38f215f20e1363805227e90066c06ebeaa56fad226902f0f8e7a9ae8de7051866e0d5aa6 SSDeep 3072:xn3NWR5gqrgpqfVVMWmO1a5U4VcOUClYBIuJEjHC0a7mhsXw:N3N5qMpeFmfGFClY2u6bC0aiv TLSH 400413C6DE29D70CDE2F3D76014666C1F2FC6698D7236A2C6173ABD60C497820D1B19B

23 files
ZIPde1ed40a5ee058ead6d0c4525977e7ce
BINRoyal_Commendation_and_Directives_2026
LNKRoyal_Commendation_and_Directives_2026.pdf.lnk
BIN[Lnk Summary]
BIN__MACOSX
BINF
DOCmFGtDjuCcFv.doc
DOCOrMUUcfsx.doc
PDFRoyal_Commendation_and_Directives_2026.pdf
BINText (Preview)
TXTPage #1
TXTPage #2
BIN#Stream obj 5 0
BIN#Stream obj 7 0
BIN#Stream obj 9 0
BIN#Stream obj 10 0
BIN#Stream obj 11 0
BIN#Stream obj 12 0
BIN#Stream obj 16 0
BIN#Stream obj 20 0
BIN#Stream obj 25 0
BIN#Stream obj 26 0
TXTStructure
DOCsdIhbIZzspb.doc
DOCveyTQvhP.doc
DOCyHskyQfH.doc
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 1secondary ignored: 2
bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes

Name Value
Version
1.7
Title
Official Royal Commendation & Directives
Producer
WeasyPrint 62.3
/Producer
WeasyPrint 62.3
/Title
Official Royal Commendation & Directives

23 files
ZIPde1ed40a5ee058ead6d0c4525977e7ce
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙