Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 111d4f831f1f7b69c1e19910f0af3c5e
Sha1 602db003c4dc7d863a604500e87eb0e892c923c9
Sha256 725fa840a70c47196797db5977b2d99654063d01310e23d0887bfc4054e143cc
Sha384 468f71d50a4c25a248c7103fd4859b7b04929d844455de320c8439fe41190a73e41f10f0688a3abbeecaea37c0dcafe7
Sha512 28565928115875904757e0fe6d2efe573c421c12c77584de01d46d967cf800e8330da95a28865607261252348dd4e5845cbfca24ac0e37200cb81a06a0852b43
SSDeep 12288:TgzOtafpCvez+ttQbQ6JMC21PbaUDJdWPFx3lhkyD3xIpT3qK40GY8L2XG2ToA8G:oONK01CaPJ9CxDXIt3jGVy22TDGa
TLSH A1153353D13B457582FFA5C7A1E21EC8C8CA12E706739F945A7D08A06B91B39E78F80D
111d4f831f1f7b69c1e19910f0af3c5e
Malicious
Запрос-спецификация от компании ООО Орбита стройпроект на октябрь 2026г.lnk
Malicious
LNK CommandLine
Malicious
[Base64-Block]
Malicious
[Lnk Summary]
Malicious
выписка из ЕГРЮЛ.pdf
Text (Preview)
Page #1
Page #2
Page #3
Page #4
Page #5
Page #6
Page #7
Page #8
Page #9
Page #10
Page #11
Page #12
#Stream obj 18 0
#Stream obj 57 0
#Stream obj 60 0
#Stream obj 25 0
#Stream obj 19 0
#Stream obj 14 0
#Stream obj 17 0
#Stream obj 3 0
#Stream obj 4 0
#Stream obj 2 0
#Stream obj 54 0
#Stream obj 58 0
#Stream obj 23 0
#Stream obj 26 0
#Stream obj 39 0
#Stream obj 40 0
#Stream obj 47 0
#Stream obj 62 0
#Stream obj 43 0
#Stream obj 64 0
#Stream obj 46 0
#Stream obj 48 0
#Stream obj 49 0
#Stream obj 50 0
#Stream obj 51 0
#Stream obj 52 0
#Stream obj 53 0
#Stream obj 9 0
#Stream obj 7 0
решение участника.pdf
Text (Preview)
Page #1
#Stream obj 1 0
#Stream obj 1 0-preview.png
#Stream obj 2 0
Structure
Карточка юр лица ООО Орбита стройпроект.doc
Root Entry
Data
1Table
CompObj
WordDocument
SummaryInformation
DocumentSummaryInformation
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3
bin 2img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1027~T1059.001~T1105
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.4
CreationDate
D:20241211082155+03'00'
ModifiedDate
D:20241211082155+03'00'
Producer
iText 2.1.7 by 1T3XT
Version
1.7
CreationDate
D:20241211120352-08'00'
Creator
HP Scan
ModifiedDate
D:20241211120352-08'00'
Producer
HP Scan Extended Application
/Creator
HP Scan
/CreationDate
D:20241211120352-08'00'
/ModDate
D:20241211120352-08'00'
/Producer
HP Scan Extended Application
/ModDate
D:20241211082155+03'00'
/Expires
0
/CreationDate
D:20241211082155+03'00'
/Producer
iText 2.1.7 by 1T3XT
Deobfuscated PowerShell UNKNWOWNmalicious
Write-huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙