test: 7a2c8630 — MalwareBazaar test-upload ZIP with trivial Python payload

Executive Summary

A 163-byte ZIP archive containing a single Python script that prints a literal string. Uploaded to MalwareBazaar with the tag test; triage pipeline flagged it for deep analysis because the test family had zero existing wiki entries. This is benign by inspection — a connector or API verification upload, not a weapon.^[file.txt]^[strings.txt]

What It Is

The ZIP uses STORE compression (no compression) and contains a single entry:

testSample.py
import os
print("test malware sample")

^[strings.txt]

No PE header, no compiled code, no imports, no C2, no persistence, no obfuscation.^[pefile.txt]^[capa.txt]

How It Works

Execution model is trivial: unzip → python testSample.py → prints "test malware sample" to stdout and exits. The import os is unused.^[strings.txt]

No anti-analysis, no packing, no staging. CAPE skipped detonation because the file type is not a supported binary class.^[dynamic-analysis.md]

Decompiled Behavior

Not applicable — artifact is a plain-text ZIP, not a PE, ELF, Mach-O, or .NET assembly. radare2 reports binsz 163, bits 0, havecode false.^[rabin2-info.txt] Ghidra/pyghidra would refuse import for the same reason. No decompilation was attempted.

C2 Infrastructure

None. No network references, no DNS, no IPs, no URLs. Static and dynamic analysis both negative.

Interesting Tidbits

• Connector test artifact — The test label, generic filename sample.zip, and literal string "test malware sample" strongly suggest this was uploaded to verify MalwareBazaar ingestion, abuse.ch API connectivity, or an OpenCTI connector.^[triage.json]
• FLOSS/capa failure modes — Both tools failed gracefully: FLOSS interpreted the command-line argument incorrectly because the file is not a PE, and capa explicitly rejected it as an unsupported file format.^[floss.txt]^[capa.txt] These failures are expected and confirm the file is not a compiled binary.
• ssdeep and TLSH noise — ssdeep emitted a hash despite the warning about small file size; TLSH declined (file too small).^[ssdeep.txt]^[tlsh.txt]
• No YARA matches — Empty yara.txt confirms no rule in the current corpus matches this artifact.^[yara.txt]

How To Mess With It (Homelab Replication)

Not applicable — there is no malware technique to replicate. For reference, the ZIP can be reproduced with:

echo 'import os
print("test malware sample")' > testSample.py
zip -0 sample.zip testSample.py

Verification: file sample.zip should return Zip archive data, at least v2.0 to extract, compression method=store.

Deployable Signatures

YARA rule

rule test_7a2c8630_zip_test_payload
{
    meta:
        description = "MalwareBazaar test-upload ZIP containing testSample.py"
        author      = "pp-hermes"
        sha256      = "7a2c8630590c2d4630dc2a1c872dd5b113c0bcef99f03f18b148ee227c17317c"
        date        = "2026-06-16"
    strings:
        $zip_hdr      = { 50 4B 03 04 }
        $inner_name   = "testSample.py"
        $py_import    = "import os"
        $py_print     = "print(\"test malware sample\")"
    condition:
        $zip_hdr at 0 and $inner_name and $py_import and $py_print and filesize < 300
}

Sigma / behavioral hunt

Not applicable — no runtime behavior to hunt. This artifact is a static ZIP and produces no process, registry, or network events.

IOC list

Behavioral fingerprint statement

This artifact is a trivial ZIP archive containing a single-line Python print statement. It does not execute any system calls, network operations, or file writes beyond unzipping. It should be treated as a benign test upload, not a threat.

Detection Signatures

• capa: unsupported file format (rejected at import).^[capa.txt]
• No ATT&CK mappings — no malicious behavior observed. If forced to classify, the closest technique is T1204.002 (User Execution: Malicious File), but the payload is harmless.

References

• Artifact ID: e446352f-8b8b-41c7-830d-e94bc21cbb4e^[metadata.json]
• Source: MalwareBazaar via OpenCTI malware-bazaar connector (labels: exe, malware-bazaar, test, zip)^[triage.json]
• Related wiki page: test

Provenance

Analysis derived from static artifacts in raw/analyses/7a2c8630590c2d4630dc2a1c872dd5b113c0bcef99f03f18b148ee227c17317c/:

• file.txt — file v5.45
• exiftool.json — ExifTool v12.76
• strings.txt — strings (GNU binutils)
• floss.txt — flare-floss (failed, non-PE)
• capa.txt — flare-capa (failed, non-PE)
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2
• triage.json — pp-hermes triage-fast pipeline
• dynamic-analysis.md — CAPE sandbox (skipped, non-PE)

No radare2 or Ghidra decompilation was performed because the file is not a supported binary.