Malicious
Malicious

ebb83d1f24c332acea4c88621b425809

ZIP Archive
MD5: ebb83d1f24c332acea4c88621b425809
Size: 629 B
application/zip
Ctrl + scroll to zoom · drag to pan

This sample is a 629 bytes ZIP Archive classified as malicious by Malva.RE (lolbin). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d7fa46efae9a9c60afb7ac9dc52a56573df9c6b351fcf6084c640348cacf40ba
MD5
ebb83d1f24c332acea4c88621b425809
Verdict
Malicious
File type
ZIP Archive · 629 bytes
Category
LOLBin

Cite this report: https://app.malva.re/sha256/d7fa46efae9a9c60afb7ac9dc52a56573df9c6b351fcf6084c640348cacf40ba

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
629 B · 629 B
First seen
2026-08-03 08:46 · 2 months ago
Last seen
2026-08-03 08:46 · 2 months ago
Last analysis
2026-08-03 08:46 · 2 months ago
Hashes
MD5 ebb83d1f24c332acea4c88621b425809 Sha1 988db0b5a691fda64bbab34724baca1d8e227e54 Sha256 d7fa46efae9a9c60afb7ac9dc52a56573df9c6b351fcf6084c640348cacf40ba Sha384 017e72b809f6afb184b45ede7f6a25be7d7ba8818a0d4e97bac70c37cbf73f787235a6685a415b4a7e01983a4f482331 Sha512 a46b2fb89789dc5eed6757a31c9c6e303cb8e8f2eb22f77d0d7c3647cbe8d6702260b6d87cba43a70b21e35d95c65cd73e1e4b7d74cc0203f66750e0a1efd2bd SSDeep 12:5jQJRiMdWwU80eqT6GdK92JRTf05nRn2bqXcGzrL/f1NGbAB7aeiMoJaj:9aRi+Wwn0eehQ2JRTeRXZf1NGbAxBiq TLSH 2EF0025F124BCE40C820D333CD6A36DAD533F59042B7DD65F2ADA16D8516B078651F85

3 malicious · 3 files
ZIPebb83d1f24c332acea4c88621b425809LOLBin
LNKContrato_Indeniza_Brasil-CGLB0R.lnkLOLBin
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.003~T1202~T1204.002
Shape arc:zip>lnk
malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 3 files
ZIPebb83d1f24c332acea4c88621b425809LOLBin
LNKContrato_Indeniza_Brasil-CGLB0R.lnkLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
ebb83d1f24c332acea4c88621b425809 › Contrato_Indeniza_Brasil-CGLB0R.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙