Malicious
c2e01ff322506f401046005da8c0cb16
ZIP Archive
MD5: c2e01ff322506f401046005da8c0cb16
Size: 1.33 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.33 KB · 1,327 B
First seen
2026-07-31 06:16 · 2 months ago
Last seen
2026-07-31 06:16 · 2 months ago
Last analysis
2026-07-31 06:16 · 2 months ago
Hashes
MD5
c2e01ff322506f401046005da8c0cb16
Sha1
9ea5c6774331b9fe46cb611701aae1b13d46598a
Sha256
ac3888a4ad3c02eddcb9a7a9a03a925faa86e655dfb4a71728299f369662cf47
Sha384
c6c62233c0246af559caa916d9f2a7d4427527db0917172651adc39dcdb4a57d7f4ee7133e8abc15be25ced549b25e0a
Sha512
26f237741929cb6249cfe9c14b5de9e6f71ec6adc3bddaad5df79eee7635f7def4ba4b7ce3150515566ab1930d4ce5262b9328297347aa49320eb18436d4c77f
SSDeep
24:9Kp1+b2yurzk3WqRONbPNy+6SO99DSgVmkSv/5cpeY/CGlaJoi6CqR:9cdUWU8Fy++91RTkcpeY5soh
TLSH
4F21EAFDC01D554AF8C4927C56C79982713467D16139A96B13CB08E1AE0ED53EBCB4CD
6 malicious · 8 files
ZIPc2e01ff322506f401046005da8c0cb16T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_553737978307.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_709000531087.mp4
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$nrys7huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 8 files
ZIPc2e01ff322506f401046005da8c0cb16T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_553737978307.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_709000531087.mp4
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
c2e01ff322506f401046005da8c0cb16 › photov_553737978307.lnk
Deobfuscated PowerShell
UNKNWOWNmalicious
$nrys7huhuhuhuhuhuhuhuhuhuhu
c2e01ff322506f401046005da8c0cb16 › photov_553737978307.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account