Deep Malware Analysis of 31da73db93c3d071eb67d2e6c4ca80bd | md5: 31da73db93c3d071eb67d2e6c4ca80bd | Zip Archive | LNK | Malicious | LOLBin | T1218: System Binary Proxy Execution | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	31da73db93c3d071eb67d2e6c4ca80bd
Sha1	78ca59ea6712dbe105f09a300a31ae984142c306
Sha256	daaa674263e12e9fd528018532df90b21c37d58f44d6c64cfcacf60cde38a7cb
Sha384	816dcfc6079dd331f3d573e460dd6172f46ca01d7e97d705145914601b8710f23a39db65635b28ff1210f40b768c8974
Sha512	c4a18a995468cf1b158a76c09ec3f8181510d503a5f0e7e179348200c7a2924f055f93be5187398f90f8e18329e4a4966cd49f07ca5e2cea7d8e138207b66b8a
SSDeep	384:u8B/5tWG6Z9gGNx/FZ2DvPzUN/IscU/d281j:uq/5tWG6ZKk3MDPg/Z5
TLSH	B742C04A86662113DFD87075FE876A7A36E9D0CC935B0CD6E3D83B81ED08153890B62D

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd

malicious 3 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Invokhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential