Malicious
ecb07d1c77939bd1a2aa029f08e86ffc
ZIP Archive
MD5: ecb07d1c77939bd1a2aa029f08e86ffc
Size: 3.04 MB
application/zip
Ctrl + scroll to zoom · drag to pan
This sample is a 2.9 MB ZIP Archive classified as malicious by Malva.RE. Static analysis extracted 35 embedded or derived files. It matches 4 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61
- MD5
- ecb07d1c77939bd1a2aa029f08e86ffc
- Verdict
- Malicious
- File type
- ZIP Archive · 2.9 MB
Cite this report: https://app.malva.re/sha256/87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
3.04 MB · 3,042,322 B
First seen
2026-10-29 06:30 · 3 hours ago
Last seen
2026-10-29 06:30 · 3 hours ago
Last analysis
2026-10-29 08:01 · an hour ago
Hashes
MD5
ecb07d1c77939bd1a2aa029f08e86ffc
Sha1
ec524ebb2862169d83501e43817026f5518e8e91
Sha256
87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61
Sha384
132eb7c0daadc5600fcd3fe762071a876e75c448a0d29103872588befe775dc59dbbe24a32dc7731e849076ebd44fa86
Sha512
8e1fcd8afe65678b09233899ca948bed24d7edb0617b0d61be4c21e2c3e4b323a5dd336b3b903cdbb67909c50729a03609ad1fd3a6f5e48eb73b91def0c41d8c
SSDeep
49152:QYxnOP1rCcEn7CBAvPVTIBSpfhngpumyM6WTVgLQdzGHs/u7H/rbZr8KMoATiCqL:9OAqOvdcBufhngp99ZzxGrTbV8fTiCLW
TLSH
E4E533944AA79C42BD0D0BECC98722FC6D7AEB3E1F57169F3C9E628476265C4E35C800
3 malicious · 36 files
ZIPecb07d1c77939bd1a2aa029f08e86ffcT1027 · T1059 · T1059.005
VBSPol_RecepGHLLExp0kdhgbcCialxune_94VED_83D2B5SELMQFirm.vbsT1027 · T1059 · T1059.005
VBSPol_RecepGHLLExp0kdhgbcCialxune_94VED_83D2B5SELMQFirm.vbs.deobfuscated.vbsT1059.005
BIN~
EXEqeuu1.xml
Structure
P7B[Authenticode]_30d33efa.p7b
BINResources
BINRT_STRING
BINID:0001
BINID:1033
BINID:0427
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
EXEzilv2.xml
Structure
P7B[Authenticode]_11300055.p7b
BINResources
BINRT_BITMAP
BINID:03E8
BINID:1066
BINRT_DIALOG
BINID:07D0
BINID:1066
BINID:07DE
BINID:1066
BINID:07E0
BINID:1066
BINRT_STRING
BINID:00BC
BINID:1066
BINID:00BD
BINID:1066
BINID:00BE
BINID:1066
BINID:00BF
BINID:1066
BINID:00C0
BINID:1066
BINID:00C1
BINID:1066
BINRT_VERSION
BINID:0001
BINID:1066
BINtakdxc
BINahmbbh
BINpoea
BINfgacxn
PDFhqzcth2.pdf
BINText (Preview)
TXTPage #1
BIN#Stream obj 5 0
IMG#Stream obj 6 0
IMG#Stream obj 6 0-preview.png
TXTStructure
PDFohbag1.pdf
BINText (Preview)
TXTPage #1
IMG#Stream obj 5 0
IMG#Stream obj 5 0-preview.png
IMG#Stream obj 6 0
IMG#Stream obj 6 0-preview.png
BIN#Stream obj 7 0
BIN#Stream obj 9 0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 5
STICH kept: 1secondary ignored: 4
bin
3img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:vbs~T1027~T1059~T1059.005
Shape
arc:zip>scr:vbs
malicious
2 nodes
| Name | Value |
|---|---|
| Version | 1.3 |
| Author | Author |
| CreationDate | D:20240722184059Z |
| Creator | XSL-FO http://www.w3.org/1999/XSL/Format |
| Keywords | keyword1, keyword2 |
| Subject | Subject |
| Title | Title |
| Producer | Fonet, Version=1.0.0.0, Culture=neutral, PublicKeyToken=52effa152c4a9dc6, 1.0.0.0 |
| /Author | Author |
| /Keywords | keyword1, keyword2 |
| /CreationDate | D:20240722184059Z |
| /Title | Title |
| /Creator | XSL-FO http://www.w3.org/1999/XSL/Format |
| /Subject | Subject |
| /Producer | Fonet, Version=1.0.0.0, Culture=neutral, PublicKeyToken=52effa152c4a9dc6, 1.0.0.0 |
| Version | 1.4 |
| Producer | Oracle XML Publisher 5.6.2 |
| /Producer | Oracle XML Publisher 5.6.2 |
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 36 files
ZIPecb07d1c77939bd1a2aa029f08e86ffcT1027 · T1059 · T1059.005
VBSPol_RecepGHLLExp0kdhgbcCialxune_94VED_83D2B5SELMQFirm.vbsT1027 · T1059 · T1059.005
VBSPol_RecepGHLLExp0kdhgbcCialxune_94VED_83D2B5SELMQFirm.vbs.deobfuscated.vbsT1059.005
BIN~
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
ecb07d1c77939bd1a2aa029f08e86ffc › Pol_RecepGHLLExp0kdhgbcCialxune_94VED_83D2B5SELMQFirm.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account