Deep Malware Analysis of 14ebb14525b1761dfc8baf3e3ce273be | md5: 14ebb14525b1761dfc8baf3e3ce273be | Zip Archive | LNK | Malicious | LOLBin | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	14ebb14525b1761dfc8baf3e3ce273be
Sha1	ecaa308e81f5b09f45f98f3b7a32179f610008a1
Sha256	b2286b7a6f14289280d6fea163995b1537311f7ad36d10252d6a800da3619614
Sha384	df5a4a323cf1feef59f824bd3011ef277ff410ffa19abeed5583d8515ef171cf566da4863466cce4751b4e14733f298f
Sha512	ae2e3eb5afd939c018b5303b6fe5f16901aaf35a0c6b59f1fabe1a63debb55851fee0555cfb68c940f371e0d7fbe902daf65da6ef77c27dbe37dad8c15717b28
SSDeep	384:9UKSgxBdtFXt/uyECQoTESzHHuKZ7TYrwlAPRMMB+2:9UbwfZupCjzuJwl2Lo2
TLSH	F372D0BE6ED75268B02897D417CF7AFF826EF30567D4C26FA3458475D0CD9A80C46092

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd

Shape arc:zip>lnk>lnk:cmd

malicious 3 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential