Malicious
d4e433e70ca0b42906f8707ccc487ebe
ZIP Archive
MD5: d4e433e70ca0b42906f8707ccc487ebe
Size: 1.26 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.26 KB · 1,256 B
First seen
2026-07-27 06:15 · 3 months ago
Last seen
2026-07-27 06:15 · 3 months ago
Last analysis
2026-07-27 06:15 · 3 months ago
Hashes
MD5
d4e433e70ca0b42906f8707ccc487ebe
Sha1
ec2bb1d436a9f0deac7a42531af5839c9c5a24ec
Sha256
7c1ac2988b9e52a911e3ebce684282ef682602b5ca449647a35adf6262b17b82
Sha384
3c756f7004cb2315ee941f87dd8c1bf2290394572d7bb6bb809d3b0c2171888b5cceaa60185884a756cf3ea8963aaa7a
Sha512
723475367507339d92bfad68ba3203529d64f7171fd01e86de4966b9e8fbce0e547bccb38ca61ed448d820550facee9bf627aaa13fceaea4ea0bb7b12bdc7d12
SSDeep
24:9nOSzTtRXVHD8l4+owP1/VKpF7LanuemSSrfR4JcyO0NdHMnmApnufg:9HlHD8f1tKnyHPigM/ug
TLSH
0421B731C577EBD4D543D9B6E88D919C00298D1DC099C769FFB330903B78960AB42334
6 malicious · 8 files
ZIPd4e433e70ca0b42906f8707ccc487ebeT1027 · T1059.001 · T1059.003LOLBin
LNKphotov_675057253184.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_860690571313.mp4
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$yit49huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 8 files
ZIPd4e433e70ca0b42906f8707ccc487ebeT1027 · T1059.001 · T1059.003LOLBin
LNKphotov_675057253184.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_860690571313.mp4
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d4e433e70ca0b42906f8707ccc487ebe › photov_675057253184.lnk
Deobfuscated PowerShell
UNKNWOWNmalicious
$yit49huhuhuhuhuhuhuhuhuhuhu
d4e433e70ca0b42906f8707ccc487ebe › photov_675057253184.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account