This sample is a 2.9 MB ZIP Archive classified as malicious by Malva.RE. Static analysis extracted 35 embedded or derived files. It matches 4 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61
- MD5
- ecb07d1c77939bd1a2aa029f08e86ffc
- Verdict
- Malicious
- File type
- ZIP Archive · 2.9 MB
Cite this report: https://app.malva.re/sha256/87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
bin
3img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
arc:zip>scr:vbs~T1027~T1059~T1059.005
arc:zip>scr:vbs
| Name | Value |
|---|---|
| Version | 1.3 |
| Author | Author |
| CreationDate | D:20240722184059Z |
| Creator | XSL-FO http://www.w3.org/1999/XSL/Format |
| Keywords | keyword1, keyword2 |
| Subject | Subject |
| Title | Title |
| Producer | Fonet, Version=1.0.0.0, Culture=neutral, PublicKeyToken=52effa152c4a9dc6, 1.0.0.0 |
| /Author | Author |
| /Keywords | keyword1, keyword2 |
| /CreationDate | D:20240722184059Z |
| /Title | Title |
| /Creator | XSL-FO http://www.w3.org/1999/XSL/Format |
| /Subject | Subject |
| /Producer | Fonet, Version=1.0.0.0, Culture=neutral, PublicKeyToken=52effa152c4a9dc6, 1.0.0.0 |
| Version | 1.4 |
| Producer | Oracle XML Publisher 5.6.2 |
| /Producer | Oracle XML Publisher 5.6.2 |