Malicious
ZIP Archive
MD5: 0cf2efa73ba34df217ea38bf717c279e
Size: 1.48 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.48 KB · 1,481 B
First seen
2026-07-29 11:31 · 2 months ago
Last seen
2026-07-29 11:31 · 2 months ago
Last analysis
2026-07-29 11:31 · 2 months ago
Hashes
MD5
0cf2efa73ba34df217ea38bf717c279e
Sha1
ad1bec9ee9ba94699e07abcd9df0b67983caed45
Sha256
f4b3816a777574f642113def076a0dd356e668af8e3354185759f682172a2fd4
Sha384
de984d84cd206f40b77d99aa43ef06656777af3756c2554a960d81cf7b65d940731703d662b3803513cfc1010cec2acf
Sha512
4a4890ebd433054a19bf912e5c3e17bcf373c24d0cfde95bc9f77afac9abb0aacb59425f8217302d988007bbe4c20cd9c4e0254c9745bb03e060db0094c8880f
SSDeep
24:9Oyo4rlkeV1TN0ujg/Ma509M2nsrmkZ++UaNuUamD+7Yp/pgbzYBn:9dZ93qn06lTZ++UkO16gbmn
TLSH
ED31C918CB8D1300F551EAFC7D3DE61E365AC2850094CB23056A50C6F78F4930B9ACE4
6 malicious · 8 files
ZIP0cf2efa73ba34df217ea38bf717c279eT1027 · T1059.001 · T1059.003LOLBin
LNKphotov_776274188255.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_489140411241.mp4
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$cfeythuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential