Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 1.2 KB ZIP Archive classified as malicious by Malva.RE (lolbin). Static analysis extracted 7 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
f7fc85d327f9c8512ef8819aa1579e4f37f769b8251d792b41702c162accc217
MD5
9097576cc735d88610c8cccbf795278b
Verdict
Malicious
File type
ZIP Archive · 1.2 KB
Category
LOLBin
MITRE ATT&CK
T1027T1059.001T1059.003T1202: INDIRECT COMMAND EXECUTIONT1204.002

Cite this report: https://app.malva.re/sha256/f7fc85d327f9c8512ef8819aa1579e4f37f769b8251d792b41702c162accc217

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
1.22 KB · 1,219 B
First seen
2026-07-27 06:16 · 3 months ago
Last seen
2026-07-27 06:16 · 3 months ago
Last analysis
2026-07-27 06:16 · 3 months ago
Hashes
MD5 9097576cc735d88610c8cccbf795278b Sha1 f290949ac9db848a1ace69517927391c67acba43 Sha256 f7fc85d327f9c8512ef8819aa1579e4f37f769b8251d792b41702c162accc217 Sha384 e5ad71ff6ed8427a652da77ad4650d6e14a9bd132a34100e462fbb3f1774daeda0d59bd78fe01d77fc2f15ac09c223b3 Sha512 519a4a1f3b321cad2527cbd564dfeca0d5b16d388b1f2a2e87eab44b97d13c78c33a92fc686e7cbb3cc820648d614adfa282dea64b1268974f2331c7e5bb10fb SSDeep 24:965dEuc0+RW9h2D+dP+rd4pBnuAOuVP4bLvYmSf+sb+Jl89WugjKt+V59EmX:965dEKYRDm+yWQPfXb+SWugOtA5N TLSH CB21D73C807EA241C702EAB9A58CE606366FD880F44CB45124F29DB33F62D44AE241DA

6 malicious · 8 files
ZIP9097576cc735d88610c8cccbf795278bLOLBin
LNKphotov_967840575221.lnkLOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_101334901591.mp4
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes

LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$q136chuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

6 malicious · 8 files
ZIP9097576cc735d88610c8cccbf795278bLOLBin
LNKphotov_967840575221.lnkLOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Lnk Summary]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
9097576cc735d88610c8cccbf795278b › photov_967840575221.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$q136chuhuhuhuhuhuhuhuhuhuhu
9097576cc735d88610c8cccbf795278b › photov_967840575221.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙