Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 1.2 KB ZIP Archive classified as malicious by Malva.RE (lolbin). Static analysis extracted 7 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.003, T1202: INDIRECT COMMAND EXECUTION and T1204.002. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
954f528dcb907ea1637accc6dbc5fc5f26313bf7c05bf107883e79635c5dac4b
MD5
bf2455bd53f652b37122760bd4ed01af
Verdict
Malicious
File type
ZIP Archive · 1.2 KB
Category
LOLBin
MITRE ATT&CK
T1027T1059.001T1059.003T1202: INDIRECT COMMAND EXECUTIONT1204.002

Cite this report: https://app.malva.re/sha256/954f528dcb907ea1637accc6dbc5fc5f26313bf7c05bf107883e79635c5dac4b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
1.2 KB · 1,200 B
First seen
2026-07-27 06:15 · 3 months ago
Last seen
2026-07-27 06:15 · 3 months ago
Last analysis
2026-07-27 06:15 · 3 months ago
Hashes
MD5 bf2455bd53f652b37122760bd4ed01af Sha1 ec31da4024d100898aecf3308d40696c055dd237 Sha256 954f528dcb907ea1637accc6dbc5fc5f26313bf7c05bf107883e79635c5dac4b Sha384 29037fce883e863bb61e362dad78bd11d2b9f4c1a264d26e47134d3e6f5b75a5e730419e348163dae9432eeb3e3c2412 Sha512 c68bb2477fd52d60a962a9157b937b3822a116f64d51008a9943eed8d5e961b826795c26ada8f7e97de44a0d581c4b454f12ba3c9f1e3c729017112a6f19cac2 SSDeep 24:9g3r/y059zCPmpi9uFWVeo/2i1Da9TBtLJiqDXJqmSeqv/UJJxaM5pWAtF:9gbf9zOmpUCWVeo/4T/L8PekUR TLSH E821A32080D8ED00CCCDD6325B47628AB71316B1F3A943232B912F9F3618B8D5B553B9

6 malicious · 8 files
ZIPbf2455bd53f652b37122760bd4ed01afLOLBin
LNKphotov_471141756376.lnkLOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_664126069446.mp4
BIN[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes

LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$yxaz9huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

6 malicious · 8 files
ZIPbf2455bd53f652b37122760bd4ed01afLOLBin
LNKphotov_471141756376.lnkLOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Lnk Summary]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
bf2455bd53f652b37122760bd4ed01af › photov_471141756376.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$yxaz9huhuhuhuhuhuhuhuhuhuhu
bf2455bd53f652b37122760bd4ed01af › photov_471141756376.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙