Malicious
ZIP Archive
MD5: 671fd52305f923899894d24a194ff95c
Size: 1.42 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.42 KB · 1,424 B
First seen
2026-07-29 11:32 · 2 months ago
Last seen
2026-07-29 11:32 · 2 months ago
Last analysis
2026-07-29 11:32 · 2 months ago
Hashes
MD5
671fd52305f923899894d24a194ff95c
Sha1
685abb6090a6e72e403e1ce838879ee1223d5056
Sha256
6a075178d97e5a5d954a4371c4411b5b869e9693f3b1885e99ccec118ff97f51
Sha384
233eb0b71626be9032d21134c591b8ced3e4b531509207831b27c89e5ba139acb93a103a01130ac228bb6418cf237793
Sha512
23ad6c007a5cf49ad40a6e2b74665285c498f8075d5fbce2ec47c6fcd3446332535726a832c9fcf237773c6c6d272ea76e73907769037dbab3d9a7496340fc01
SSDeep
24:9suBpoJ4mjvefoA12WvQuZpxVLBNAOjKspLumkf2+UaNuUamyHLTsG0c:9sCq4wmfoA1rvZpLbLuTu+UkOB3l0c
TLSH
BF21890094428B70DE57ED36F8299485A94B8362171174D31F35B3922ACF4219F2B8ED
6 malicious · 8 files
ZIP671fd52305f923899894d24a194ff95cT1027 · T1059.001 · T1059.003LOLBin
LNKphotov_605234264245.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_690311923629.mp4
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$l88a huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential