Sign up free
Ctrl + scroll to zoom · drag to pan

The file bb952709ef032b6e89a58f96a025b1b73eb16a2ca9ff2d4c4afeaedeff174c6d_password_infected.zip is a ZIP Archive. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 9 embedded or derived files. It matches 7 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.001, T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
No known threat found
File type
ZIP Archive
Category
LOLBin

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive

9 malicious · 10 files
ZIPbb952709ef032b6e89a58f96a025b1b73eb16a2ca9ff2d4c4afeaedeff174c6d_password_infected.zipLOLBin
TXTfilename.txt
ZIPbb952709ef032b6e89a58f96a025b1b73eb16a2ca9ff2d4c4afeaedeff174c6d.binLOLBin
LNK37d7f927abcd4d1bf617e8279b8b8d7c8b14abec089e856faa6ffe36937c4e16.lnkLOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]

LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$obf_lhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$obf_lhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙