Malicious
Malicious

This sample is a 1.2 KB ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 7 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
496201127e12ad5f22beb46a05622914f8756d93ec74c98e7e652868f62f46d5
MD5
95d1a4e8e7bb8e04a21d6576376a3b38
Verdict
Malicious
File type
ZIP Archive · 1.2 KB
Category
LOLBin
MITRE ATT&CK
T1027T1059.001T1059.003T1202: INDIRECT COMMAND EXECUTIONT1204.002

Cite this report: https://app.malva.re/sha256/496201127e12ad5f22beb46a05622914f8756d93ec74c98e7e652868f62f46d5

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
1.26 KB · 1,260 B
First seen
2026-07-27 06:31 · 3 months ago
Last seen
2026-07-27 06:31 · 3 months ago
Last analysis
2026-07-27 06:31 · 3 months ago
Hashes
MD5 95d1a4e8e7bb8e04a21d6576376a3b38 Sha1 00d48537a87f653b1e014f62db913ba12fae9d23 Sha256 496201127e12ad5f22beb46a05622914f8756d93ec74c98e7e652868f62f46d5 Sha384 a96004b95c83ad66b5fbe35a818cf5b5228a71d61015735daa16e680f71dd70f1a6acf62b34cc09af84c57f2cdb8528c Sha512 d94621409cf0efe182a7bfa288aface0d03b665f366905ee5df27554cde08c096631c10ad14d005529a79d3a1009b7c272b8b19214a24b2d6707c057bd1430d5 SSDeep 24:9AFYtTYVMGWfS5MNk7rx2bnQhrHYgFmSRY4+HQcZEBGM5:9J1YVDWfKHiQN4gFPRYtpK TLSH CA2184D5C76C7039CE0B8E323A3195D1321D86F1985182DD52AA2BE03FA9B982B54D99

6 malicious · 8 files
ZIP95d1a4e8e7bb8e04a21d6576376a3b38LOLBin
LNKphotov_724368231120.lnkLOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_294639862122.mp4
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes

LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$lk0_0huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

6 malicious · 8 files
ZIP95d1a4e8e7bb8e04a21d6576376a3b38LOLBin
LNKphotov_724368231120.lnkLOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Lnk Summary]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
95d1a4e8e7bb8e04a21d6576376a3b38 › photov_724368231120.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$lk0_0huhuhuhuhuhuhuhuhuhuhu
95d1a4e8e7bb8e04a21d6576376a3b38 › photov_724368231120.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙