Edgecution Zip Missing Pk Magic Bytes
Detects a downloaded archive that does not begin with the standard ZIP local file header 'PK' magic bytes yet still contains valid ZIP central directory or end-of-central-directory signatures alongside Edgecution-specific package content (extension/background.js path, embedded python-3.13.3-embed-amd64-with-pip.zip runtime, or the com.ppeasqabfpxcz.api native messaging host id), consistent with the Edgecution/UNC6692 technique of stripping PK bytes from archives (e.g. patch3265343.a) before an AutoHotkey stager reconstructs bsvqikydknqqk.zip by prepending 0x50 0x4B at runtime
YARA
