Malicious
3ae5f003a47bf8f38ed5ef0c8830d129
ZIP Archive
MD5: 3ae5f003a47bf8f38ed5ef0c8830d129
Size: 1.09 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.09 KB · 1,093 B
First seen
2026-07-27 06:17 · 3 months ago
Last seen
2026-07-27 06:17 · 3 months ago
Last analysis
2026-07-27 06:17 · 3 months ago
Hashes
MD5
3ae5f003a47bf8f38ed5ef0c8830d129
Sha1
549a3cda02a6578951405508de418295eecc7b0d
Sha256
452d3086d68d0d58ac69f50d1fca990cc09d677ed078898502c31e69afe4cc47
Sha384
93c356a89aa8a3a337d9ad54626f6ec42b1601da87779751e02db1d1d17f4085dd488fc4aca2cf939133848d0cd579fb
Sha512
e21f6aec6b177a9e8dab89647920460f033f0e36ca7bef4b34bb6d06fdc59037497b04c7decebeb3eb5525c18a5702a1f57ff07af9580ff2bf64b43f9882c74e
SSDeep
24:9LxKwALPqp/czQ1i9KK8G/K4ZOS+8RpQdmUMrSlenHSI1WYt:9MqwQY9v8h4ZJ+gmoOQnys
TLSH
EF11860460AA8610CD0F8E33F95A26A6543F235893015517FB5875FB1512DC4BF46A44
6 malicious · 8 files
ZIP3ae5f003a47bf8f38ed5ef0c8830d129T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_399399323489.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_401435824529.mp4
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$lzv_7huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 8 files
ZIP3ae5f003a47bf8f38ed5ef0c8830d129T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_399399323489.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_401435824529.mp4
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
3ae5f003a47bf8f38ed5ef0c8830d129 › photov_399399323489.lnk
Deobfuscated PowerShell
UNKNWOWNmalicious
$lzv_7huhuhuhuhuhuhuhuhuhuhu
3ae5f003a47bf8f38ed5ef0c8830d129 › photov_399399323489.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account