Malicious
ZIP Archive
MD5: f4e06a20dde211f612ea7959486c1b46
Size: 24.8 KB
application/zip
Ctrl + scroll to zoom · drag to pan
This sample is a 24.2 KB ZIP Archive classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 6c6cd623b9a6faf83d996401c609d1c8decf884554786d09e3a4b0d95355e387
- MD5
- f4e06a20dde211f612ea7959486c1b46
- Verdict
- Malicious
- File type
- ZIP Archive · 24.2 KB
Cite this report: https://app.malva.re/sha256/6c6cd623b9a6faf83d996401c609d1c8decf884554786d09e3a4b0d95355e387
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
24.8 KB · 24,804 B
Hashes
MD5
f4e06a20dde211f612ea7959486c1b46
Sha1
650a5ffa7e8db0606c0cac22280c43404ae228e9
Sha256
6c6cd623b9a6faf83d996401c609d1c8decf884554786d09e3a4b0d95355e387
Sha384
4b0c294e1d3b752eb206f377b100cd63799cff65da37b83562432277d464731ffc1e8a87be37ab56fb0a62b73e4ea4bf
Sha512
112403892c00f4fb9d056047b213a7a78fd98738d29306dcdab68bebb18f90319e664359f6c7599977693071373df85c8f9ae6cb4c1b1f17b647551c2f88bd7e
SSDeep
384:lPS3/O2gWZ0j+rs0XiZOGDTIe6g9Pj5lvVIWF1v3mdWNgUlWDiJCNqGkeeyDy:l+/O2gx+tM5l55lvVIWFF0qGkeep
TLSH
B4B2E07207DCB8D4D79C065051E27EFF8F8CC922CD0DEECB2D9247508963A848B6526D
3 malicious · 3 files
ZIPf4e06a20dde211f612ea7959486c1b46T1027 · T1059.005
VBSDeoppilate87.vbsT1027 · T1059.005
VBSDeoppilate87.vbs.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:vbs~T1027~T1059.005
Shape
arc:zip>scr:vbs
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential