Malicious
20989c78b1e51478ebea87d03005095e
LNK File
MD5: 20989c78b1e51478ebea87d03005095e
Size: 3.59 KB
application/x-ms-shortcut
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 20989c78b1e51478ebea87d03005095e |
| Sha1 | c92273a160f9bf7c2f565ac57ba8d63e4def834b |
| Sha256 | 385b70c5cddf2e9fe4a4951dab0dc8dc0eee6271a2699a0051d385b476cb249b |
| Sha384 | 281d0e36be1a1370c5ecee1a31cafe9782afeb9cc8dbdff6340ddd6c31bf4d601d0b474e85b016863285ed937bc6ddf2 |
| Sha512 | 600544bb930f644394d99c835d81ba8ccf26ac9015c2158429a8c3d508c4d6239ef348469e99f1dfb7fe066b5e27d950c35c1c95d031a72dfae60c96ac47e900 |
| SSDeep | 48:89pr1Ze28Yc0C8wVdsyAYiHYEC+m1cd00E2/XuH96BPozq4:89pr1dQ8w34YiHpC+iafudIPozq |
| TLSH | 8171ED2117F50308F3B76B39ACB7B5215833B925FE32CF8D4090414E1962624D47AF2B |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105
Shape
lnk>lnk:cmd>scr:ps1
malicious
3 nodes
Path
lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001
Shape
lnk>scr:ps1
malicious
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-commahuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$u = "huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-commahuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$u = "huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
20989c78b1e51478ebea87d03005095e
Deobfuscated PowerShell
UNKNWOWNmalicious
-commahuhuhuhuhuhuhuhuhuhuhu
20989c78b1e51478ebea87d03005095e › LNK CommandLine
Deobfuscated PowerShell
UNKNWOWNmalicious
$u = "huhuhuhuhuhuhuhuhuhuhu
20989c78b1e51478ebea87d03005095e › LNK CommandLine › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
-commahuhuhuhuhuhuhuhuhuhuhu
20989c78b1e51478ebea87d03005095e › LNK CommandLine › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
$u = "huhuhuhuhuhuhuhuhuhuhu
20989c78b1e51478ebea87d03005095e › LNK CommandLine › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.