Malicious
ca06129db04047c4068c3c415fefb127
ZIP Archive
MD5: ca06129db04047c4068c3c415fefb127
Size: 1.13 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.13 KB · 1,130 B
First seen
2026-07-27 06:17 · 3 months ago
Last seen
2026-07-27 06:17 · 3 months ago
Last analysis
2026-07-27 06:17 · 3 months ago
Hashes
MD5
ca06129db04047c4068c3c415fefb127
Sha1
845a74495e4febbb96d8157bea58c45639d45204
Sha256
627cdc705609305e06e5a852d840457636517650ad17cb13f8e8b5b0fede07fc
Sha384
3a266e0f9cf9b261b57acb43f4f56432ad7ce37ffeb351e7817fe00c737d08c452d0b2e2706a1ce31db8a3074493685a
Sha512
8308e73f63710be987f81a2ba3451c92bf3b9b1453865f48c3cb30f525051880df5ffd2335c4448a838555aac83afbec25766c0ed2fc4ed166a2eb5e91df4d04
SSDeep
24:9Eekduq5j7FMjOzwbEfWQjIwZt3xmSziHO4JmZXTA+tl:9w5vFMjOzwcBHxPk6Z0+X
TLSH
02218648C54F8FD4EC3D933555B0CF1055302023E549D69E37925646F717F9A5705361
6 malicious · 8 files
ZIPca06129db04047c4068c3c415fefb127T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_775397014933.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_825041879582.mp4
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$r7tdmhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 8 files
ZIPca06129db04047c4068c3c415fefb127T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_775397014933.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_825041879582.mp4
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ca06129db04047c4068c3c415fefb127 › photov_775397014933.lnk
Deobfuscated PowerShell
UNKNWOWNmalicious
$r7tdmhuhuhuhuhuhuhuhuhuhuhu
ca06129db04047c4068c3c415fefb127 › photov_775397014933.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account