Malicious
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
23 malicious · 24 files
ZIP48fffa5f7a586716a7c83d22e8619cf2T1059.001 · T1059.003 · T1059.005LOLBin
LNKAkt_neprybutkuvannya_boyeprypasiv.docx.lnkT1059.001 · T1059.003 · T1059.005LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]T1059.005
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary].deobfuscated.vbsT1059.005
LNKNakaz_neprybutkuvannya_boyeprypasiv.docx.lnkT1059.001 · T1059.003 · T1204.002LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
TXTREADME.txt
LNKSpysok_boyeprypasiv.docx.lnkT1059.001 · T1059.003 · T1204.002LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential