Malicious
85717735af709f1b38c5f33bbf12177b
ZIP Archive
MD5: 85717735af709f1b38c5f33bbf12177b
Size: 1.35 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.35 KB · 1,349 B
First seen
2026-07-29 11:34 · 2 months ago
Last seen
2026-07-29 11:34 · 2 months ago
Last analysis
2026-07-29 11:34 · 2 months ago
Hashes
MD5
85717735af709f1b38c5f33bbf12177b
Sha1
280066b48e0c94530614c66e24da2c743bbcfab0
Sha256
e996cfdad8da2c623d24005b615276179f74b64a0cc3ff1e0de40f73e6ff8ce0
Sha384
ed3f5addb2b4e16817fffc0350b4bb02f20ea1c7dd1617254f03fdd28ff9c764d7493e997148881dc2ad3737820de323
Sha512
baee0be67383d98560bba0d458b17d9f38b3212e660db485c43e986dcbcad622033e35faa5cfa4582b1dc976fcd2d03df890f00a98e5fe852fba44ea9024d9ff
SSDeep
24:9rVQQWvmDIQNqEshGDDsLFLzlOBUPja167CwF4l+d4KYmk0TbvAxkLGiBeR4KT:9rP9iODwZjB7CipXYT0Tr1LGiqXT
TLSH
A121C850DAEDC758C5E35636F8360AAC3460A1154605CBEA775A8A4EB459208920BE3E
6 malicious · 8 files
ZIP85717735af709f1b38c5f33bbf12177bT1027 · T1059.001 · T1059.003LOLBin
LNKphotov_961998800370.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_993170888983.mp4
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$jhf0jhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 8 files
ZIP85717735af709f1b38c5f33bbf12177bT1027 · T1059.001 · T1059.003LOLBin
LNKphotov_961998800370.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_993170888983.mp4
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
85717735af709f1b38c5f33bbf12177b › photov_961998800370.lnk
Deobfuscated PowerShell
UNKNWOWNmalicious
$jhf0jhuhuhuhuhuhuhuhuhuhuhu
85717735af709f1b38c5f33bbf12177b › photov_961998800370.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account