Deep Malware Analysis of 1f5cb91be99179a31cb9a8d45dcb3602 | md5: 1f5cb91be99179a31cb9a8d45dcb3602 | LNK | Malicious | LOLBin | T1218: System Binary Proxy Execution | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	1f5cb91be99179a31cb9a8d45dcb3602
Sha1	72e982c7454c769752ff6a8fcce9d66f8425e608
Sha256	b1e14f69dbf695fdb0f9e2c2beb40bbcd7a0c4a0a9c8c12861ea8187055173ff
Sha384	b3fc37ff2ce5299a4f7c076be569412ef5e68be3f3827f49772f7493c5ac2471da3f8db95d925d1e7cc5b807f086d0f9
Sha512	b282e29a1ff69d5c6d533d7678335ff0f1e529b0a4f3e01b9bba78bed24007a0fdddbc46765eb7d364dec7735c35e379a3d01dfc435b9528956c070f0ec4fd66
SSDeep	12:80m/3BVSXvk44X3ojsqzKtnWNtW+UcCsvXrjQL6H/sf2ciNfHOYSloGYGND:8J/BHYVKVWO+/CWw+zZGXb5
TLSH	901128144EF25714E3F2DB396CBA731289767C46EE528FCD128052886820220F8B5F2F

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1059.001

Shape lnk>lnk:cmd>scr:ps1

malicious 3 nodes

Path lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001

Shape lnk>scr:ps1

malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

aaaz.thuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential