Malicious ZIP Archive (LOLBin) analysis – 927e57380a5e

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

Size

1.22 KB · 1,224 B

First seen

2026-07-27 12:17 · 3 months ago

Last seen

2026-07-27 12:17 · 3 months ago

Last analysis

2026-07-27 12:17 · 3 months ago

Hashes

MD5 52c478600969696470ec55513f2439c0 Sha1 beecc44c72abc5767eb25cfa23f05b993414e647 Sha256 927e57380a5e93e42b9895d5cb8ca9de0a389e2b9f1a52277e895065d3ba7ab7 Sha384 461b7fb67de05604113eaa1466665670322c99b355680820a1bfa127f720227913111de9c8e0ecb9c470ebcdf31be729 Sha512 f35950da73865f4d2add73a21177481e7bc01ee477604606434e0a9fc5a3f82c53754b87d65f9d9eb8441e41de9318dd7f274accd4d28e61e2cb787ddb613aa3 SSDeep 24:97+oLhDkZd9Y7O14mCjRnNX9eRmZRBdTZvtF3mSd3JJxF95p2k:9SoLRk/2OimOnfeRcBd9vtZPdj39d TLSH 2E21DA78C1A991C1C94F23316C3DC5C0333E4B5C622C20B7D28714A21D93B69050BEE5

6 malicious · 8 files

ZIP52c478600969696470ec55513f2439c0LOLBin

LNKphotov_156725122740.lnkLOLBin

SHLNK CommandLine

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Lnk Summary]

LNKvideoa_457766832087.mp4

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Path arc:zip>lnk

Shape arc:zip>lnk

2 nodes

LNK: Command Execution UNKNWOWNmalicious

%COMSPhuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$cu4u8huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential