Malicious
e29fe20af61bf86f54aec5001b497fc0
ZIP Archive
MD5: e29fe20af61bf86f54aec5001b497fc0
Size: 1.16 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
1.16 KB · 1,158 B
First seen
2026-07-27 06:31 · 3 months ago
Last seen
2026-07-27 06:31 · 3 months ago
Last analysis
2026-07-27 06:31 · 3 months ago
Hashes
MD5
e29fe20af61bf86f54aec5001b497fc0
Sha1
86c747a168b39974b88d211b3520efdfb2f0e23a
Sha256
f179130f68a4fdb360c30bcb0469d9b4b6f878db9b1c692b8e3c72db5541124c
Sha384
d38d68eef35abf714cdb77524d32b25a53bdd91ce912e8fa6c65904f54c404f6eab91cb666c1f6bef3aa3b76ac2b5e0d
Sha512
37d75828809fe98c70587e56c326c35327ee3d5143f9d33ddf046a7c78eb22272fd85a0dd4d105fc98371bf0f9b8aa3e0bb192bc63023ac8613c2bd4c8cd7424
SSDeep
24:9dnElMWqKVRtFvLZ47HdFM/jCfgPJS8JRtqHmSn9e4NWyKCgn7T2tJm:9l4MMRtj47LMbMYAmCHPn9Waiam
TLSH
E921C6C0A02DCB00F80DF932A5693CA83A262150B08A938B5312A62B9887ACC17005E9
6 malicious · 8 files
ZIPe29fe20af61bf86f54aec5001b497fc0T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_784191223155.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_707387913679.mp4
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
arc:zip>lnk>lnk:cmd>scr:ps1
malicious
4 nodes
Path
arc:zip>lnk
Shape
arc:zip>lnk
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$tmh_bhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 8 files
ZIPe29fe20af61bf86f54aec5001b497fc0T1027 · T1059.001 · T1059.003LOLBin
LNKphotov_784191223155.lnkT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Lnk Summary]
LNKvideoa_707387913679.mp4
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
e29fe20af61bf86f54aec5001b497fc0 › photov_784191223155.lnk
Deobfuscated PowerShell
UNKNWOWNmalicious
$tmh_bhuhuhuhuhuhuhuhuhuhuhu
e29fe20af61bf86f54aec5001b497fc0 › photov_784191223155.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account