Malicious
f47e52a3e8def2564c9d51858e8ae134
ZIP Archive
MD5: f47e52a3e8def2564c9d51858e8ae134
Size: 627 B
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
627 B · 627 B
First seen
2026-08-03 08:53 · 2 months ago
Last seen
2026-08-03 08:53 · 2 months ago
Last analysis
2026-08-03 08:53 · 2 months ago
Hashes
MD5
f47e52a3e8def2564c9d51858e8ae134
Sha1
2e72d25babfec2388e2283d6d631d5c8bb852286
Sha256
bd7f22d307f187f232323b774c8d74be2d08a3cf172973d13b5e8903065fdec3
Sha384
310a2a2aa7007d67be33dced5d3ed03966902d6b51b028e45da3ebb81da56adaedd92f6b67aed089f7c30f0299fc5f24
Sha512
21a44c4bdb0be986cd68524a7d2b4a3247e7327559f7c03cd8c37373706953f93d26e57d1797e55609a1fb974a7fedcb03c3b696cf67fb465621f4bba1166454
SSDeep
12:5job5/DhpRLamSMzrwqdP0F8kFYrR8J2pQ6YtKMOyQenJybI5aZXn:9obx9p6erwOP0F8C6+6YZOnyybV
TLSH
04F0025014725503D0494A321FB737499530A8F2601EFED7C175CFFB642A2D3CA51E38
3 malicious · 3 files
ZIPf47e52a3e8def2564c9d51858e8ae134T1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
LNKALVESHOTEL_VOUCHER--18SRY9.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.003~T1202~T1204.002
Shape
arc:zip>lnk
malicious
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 3 files
ZIPf47e52a3e8def2564c9d51858e8ae134T1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
LNKALVESHOTEL_VOUCHER--18SRY9.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
f47e52a3e8def2564c9d51858e8ae134 › ALVESHOTEL_VOUCHER--18SRY9.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account