Malicious ZIP Archive (LOLBin) analysis – 1e895bdc47c2

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

Size

1.08 KB · 1,080 B

First seen

2026-07-27 09:16 · 3 months ago

Last seen

2026-07-27 09:16 · 3 months ago

Last analysis

2026-07-27 09:19 · 3 months ago

Hashes

MD5 da766abd095b417a1019b0e5dbbdbaff Sha1 6468ac015e3e7f53cd08585dcef16c9bd8813983 Sha256 1e895bdc47c20de0b4480e1cf34a6e460c46698a42262252c4d0d97e153340f4 Sha384 0b713b059fd6dbc6b6216cac9d37394c6cb9637ac06e09f73e2c9b551b75ef43d971558b5f3c8501dc9388e1a22fd28f Sha512 035560f68baa6b83b00b2c545d2779fdb48fa637b031dcf4f573a6fff5433ef0b9697567c165fb08370acdc1feb440c0387bc71ac215bafd1b98d5bd439d4984 SSDeep 24:9RSZ2zHds798BajYHs71sRa/WVa+FamSIlLuSKVQ5SQpVN:9RxG7u7sBsRDVfQP4HKVU9N TLSH 8011B52D0CEF8E13CC2AC5722683765AA77941D81B43D95B9BFC37A2380B5C48301D05

6 malicious · 8 files

ZIPda766abd095b417a1019b0e5dbbdbaffLOLBin

LNKphotov_646531234327.lnkLOLBin

SHLNK CommandLine

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Lnk Summary]

LNKvideoa_185322072935.mp4

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Path arc:zip>lnk

Shape arc:zip>lnk

2 nodes

LNK: Command Execution UNKNWOWNmalicious

%COMSPhuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$yfu3rhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential