Malicious
ddabd52957147fd2880bf04de3f750e2
ZIP Archive
MD5: ddabd52957147fd2880bf04de3f750e2
Size: 1.4 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.4 KB · 1,404 B
First seen
2026-07-29 11:32 · 3 months ago
Last seen
2026-07-29 11:32 · 3 months ago
Last analysis
2026-07-29 11:32 · 3 months ago
Hashes
MD5
ddabd52957147fd2880bf04de3f750e2
Sha1
ebf3bbc1c5d0888ef8cbad03f8d72fd64b16eab1
Sha256
05960451cd9f8bf4923f125aff729b16050a0c0a251b6792292126a5037a64a1
Sha384
acbf96e10dd2b8387fe155f5f27e00d334a8672d4a5528f748120211b594d7b1090af4ddc7820f51844e45af178efc14
Sha512
f8f34cc590058e1e25a2fa43bfa2e8fa1a252d72b02e6893a6cc447ed4d4d04a65afd80a8acdd3dcf481875b38763f16e95ca8728932932f7aa4567f974656aa
SSDeep
24:9UuMn9RKjDBIAS5ECdetTCJuvlUivU31Sb/UbKmkNMtubjeYiNKA9MmgTnmbXB:95M0DSEqyTCJMluA/kKTaIb29MmgTKx
TLSH
4521862C851E4A25D5479035A0395F3B26279839045A0EDB04C0B3672229BF44FD5C98
6 malicious · 8 files
ZIPddabd52957147fd2880bf04de3f750e2T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_323085435055.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_904112687634.mp4
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$vrcbihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 8 files
ZIPddabd52957147fd2880bf04de3f750e2T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_323085435055.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_904112687634.mp4
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ddabd52957147fd2880bf04de3f750e2 › photov_323085435055.lnk
Deobfuscated PowerShell
UNKNWOWNmalicious
$vrcbihuhuhuhuhuhuhuhuhuhuhu
ddabd52957147fd2880bf04de3f750e2 › photov_323085435055.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account