Malicious
b40c7f30ebd91328521c31d0956d7e36
ZIP Archive
MD5: b40c7f30ebd91328521c31d0956d7e36
Size: 1.12 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.12 KB · 1,119 B
First seen
2026-07-27 12:16 · 3 months ago
Last seen
2026-07-27 12:16 · 3 months ago
Last analysis
2026-07-27 12:17 · 3 months ago
Hashes
MD5
b40c7f30ebd91328521c31d0956d7e36
Sha1
6ff0b5417520fad260536929f531e84006c2a865
Sha256
f1dc53a3893be33af448e298c87dfd0eb116b5c6cb21416ef1b0cfc26d9ed9b4
Sha384
6ab860fdd5b28f3a860163f69e1e4de4fc8ea09a2ea669d103c1719de207f4de8e3c9f059d2883f9b6bbd8b97412e4be
Sha512
0f4f2e9b0d0068e51ce6f04466dae72389796c1f49485b0f8fb11f321a56e7f9b11e49d0d775fa7551bd415a305571dce38ee680cf9ca237cdc19abfc71b4f3e
SSDeep
24:9J33tW2JnVODBzpf9ZITnu1njlsaamSeH4n99DgnSRES8A5UG7U:9J0EOdzpf9ZITaZsaaPl3cSREpAb7U
TLSH
C92182B8500DD990CA0BC23E7E25788B591E8D3D0A2181BB63CFB0E16C068BDA752F00
6 malicious · 8 files
ZIPb40c7f30ebd91328521c31d0956d7e36T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_222223920714.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_034207516625.mp4
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$qk42ohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 8 files
ZIPb40c7f30ebd91328521c31d0956d7e36T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_222223920714.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_034207516625.mp4
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
b40c7f30ebd91328521c31d0956d7e36 › photov_222223920714.lnk
Deobfuscated PowerShell
UNKNWOWNmalicious
$qk42ohuhuhuhuhuhuhuhuhuhuhu
b40c7f30ebd91328521c31d0956d7e36 › photov_222223920714.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account