Malicious ZIP Archive (LOLBin) analysis – d1bc696ed4fd

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

Size

1.17 KB · 1,169 B

First seen

2026-07-27 06:31 · 3 months ago

Last seen

2026-07-27 06:31 · 3 months ago

Last analysis

2026-07-27 06:31 · 3 months ago

Hashes

MD5 2f1924a50d1999bfca3677c2a2d8c7d9 Sha1 b49b992a667b33e6de727294afa4bcd3eb58966d Sha256 d1bc696ed4fd9e9c79ad5b9a6246e5a386f8b939e529ee9bd64511bfb5730575 Sha384 c08a37f96304a368a54d44caa0e0d2a86977d454c3ea364bf9b6f6761c15d166a02c34e145c2a33884268611967455e6 Sha512 5209a860752baa2c0531c02e4ebf9e405f0f3e0fdaeb1aea8ff715020f9e9d659096826a3bd1b5b12fb1761231a7d3116807be9db3ea98590271b5c4a9cbc598 SSDeep 24:90SoC0D+E2lvZ5LvY4WdashVILnD385hmSYV4R8W6lU32A55:90SD0GvZ5laa2V2D8PJr TLSH E021C660C0C16C16F99F3433703A9D9A44280B0E400D849E7771A89ABB3FDCCBB049E8

6 malicious · 8 files

ZIP2f1924a50d1999bfca3677c2a2d8c7d9LOLBin

LNKphotov_927004824038.lnkLOLBin

SHLNK CommandLine

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Lnk Summary]

LNKvideoa_742410083322.mp4

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Path arc:zip>lnk

Shape arc:zip>lnk

2 nodes

LNK: Command Execution UNKNWOWNmalicious

%COMSPhuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$lib96huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential