Malicious
LNK File
MD5: 13a1093c4ee1dbd140553cd12de813ee
Size: 13.75 KB
application/x-ms-shortcut
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Shortcut Link File
Size
13.75 KB · 13,752 B
First seen
2026-09-24 09:30 · one month ago
Last seen
2026-09-24 09:30 · one month ago
Last analysis
2026-09-24 09:30 · one month ago
Hashes
MD5
13a1093c4ee1dbd140553cd12de813ee
Sha1
01626e6609c56a9a9dc95a0df7e7f663208d4151
Sha256
50a3c4f10bcf4b13b2548faf5c52d60ae6c160ea204ae13115152c3957debd8e
Sha384
f2c2ab2628c668a2d1f85afa5ebc41e8d344f83064b4f2f33e80f8196fc6e43044234eb9ddbd8517677eabc6587ab50c
Sha512
b02b46336cc52e33c8a6b8e846b88780782e8f5980c107bd38a8cac9cfe1858401457906dea7eaba9e41fa4ebf6eb027f741d4207b5e0247f43259fc0521fd9b
SSDeep
24:8CqJdGQ3PfPgy/wit2i6pirVjhg8+Whxs1tGax4I0:8L3PfT2KNy4dI
TLSH
9F529E1039F41600E6B65B3EA877A31098773D45ED32C78C125CA90D5F27640D5B2F37
7 malicious · 7 files
LNK13a1093c4ee1dbd140553cd12de813eeT1027 · T1105 · T1059.001
SHLNK CommandLineT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[Lnk Summary]T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1027~T1059.001~T1105
Shape
lnk>lnk:cmd>scr:ps1
malicious
3 nodes
Path
lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001~T1105
Shape
lnk>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialLNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"Invokhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential