Malicious
ZIP Archive
MD5: f92a92fe2c850d2015192be1ddba2023
Size: 60.19 KB
application/zip
Ctrl + scroll to zoom · drag to pan
This sample is a 58.8 KB ZIP Archive classified as malicious by Malva.RE. Static analysis extracted 8 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- b2073d6f70126ee35783b2b59927b340e14bad9e855462509d9e752499a45dd1
- MD5
- f92a92fe2c850d2015192be1ddba2023
- Verdict
- Malicious
- File type
- ZIP Archive · 58.8 KB
Cite this report: https://app.malva.re/sha256/b2073d6f70126ee35783b2b59927b340e14bad9e855462509d9e752499a45dd1
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
60.19 KB · 60,187 B
Hashes
MD5
f92a92fe2c850d2015192be1ddba2023
Sha1
8f12d15c5217fcc0282e3615bd558f16429c7025
Sha256
b2073d6f70126ee35783b2b59927b340e14bad9e855462509d9e752499a45dd1
Sha384
dfb625c9c8616db66e687ef12d42d1f6c31ba0226fd4c03e7563b28d6d7fbb87a90208c201d86b079d6a698aa60e1ab4
Sha512
f04ac0ccc622b3f56ceb1c6cfb0764095137cef0ff3c1973ab3eac479d7bc1db93e2bc4a8fc629399c5c8608ca6f6cfd4960f1fedb6491e34d2b77822b9688e5
SSDeep
1536:4CJtuyDFJPXYD+fqIQxYlun6FphEwZ/V8svl6kDu:/tHPalssn6Fp+YxUf
TLSH
6743021E09E6A453C78D36B32101CB476B07478C88CC6ABF4D2D5D7E6ED26E9900AFD9
9 malicious · 9 files
ZIPf92a92fe2c850d2015192be1ddba2023T1027 · T1059.001 · T1059.005
PS1PaymentInvoice.vbsT1027 · T1059.001 · T1059.005
VBSPaymentInvoice.vbs.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
arc:zip>scr:ps1>scr:vbs>scr:ps1
malicious
4 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential