Malicious ZIP Archive (LOLBin) analysis – 9d652945421a

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

Size

1.3 KB · 1,296 B

First seen

2026-07-29 11:31 · 2 months ago

Last seen

2026-07-29 11:31 · 2 months ago

Last analysis

2026-07-29 11:31 · 2 months ago

Hashes

MD5 909658d8ed94ca6fbd83eecb609e4017 Sha1 29055432a458dc5fbc085c8eaabe76c788ad4acc Sha256 9d652945421add47e3f0dcc5d873854376e1739ed45260237094c3f48a5a3982 Sha384 f3ba84fea9a3e62b3e2f9eceff3db943cbcd01c63012172aeac025f2e242817c54616f689276e642fd5e8e6c4834ee12 Sha512 d979bbcfe97308116f31a77d1555595c2ff8414713e29a4b24d9d11990954662a1b708a61bbb5e7d3bbe378da7504c5578d54f8b797337d15bdf869d95715d1c SSDeep 24:9lS0AJ2MaAn+3W5nMeSzpAXRRBNtXDFmkt3LbW3sW8xf7ZgE1LJs:9lS0AJ2M3+03SzpABRb5FTt3O1uf7Zgv TLSH 6D21E76DCD10E05BEBE0E076742C2AA88B8DB0B6562187EF71760505AE071327B130F9

6 malicious · 8 files

ZIP909658d8ed94ca6fbd83eecb609e4017LOLBin

LNKphotov_147613231191.lnkLOLBin

SHLNK CommandLine

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Lnk Summary]

LNKvideoa_600258473807.mp4

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Path arc:zip>lnk

Shape arc:zip>lnk

2 nodes

LNK: Command Execution UNKNWOWNmalicious

%COMSPhuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$uhiyehuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential