Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 4c8ed3f11561a13d7a9b3516ee8c59d6
Sha1 1fad23a6287816b768d2d0a9977b57e3ea6c61d9
Sha256 a11ef5f0f05586bc4798a035cba17d252c94f2f36c5322cd15235c3fc51b6c4c
Sha384 412a5dc9fec6eff5a5732b0e6a9fced374d31c5d0eaf525cfdd12252355f6d19938c05ffcd5517f16619efe18f611978
Sha512 730a21830a1e4ca5ef004067a276580edba2ccd5d18d15a205127117d8e53be55b6b4606215658cf60c28d71d0868eaa7b275dd2af9116c6502399d4bcbb7c99
SSDeep 48:95ewE4mVp49kcNEDZl3htQowf40UKlVMNeUyvRXqsOvxvp:+wE4mVpgxEDV+owr7lVMBylqrvp
TLSH 88413B05BE21C0EBC348913A66EB6EDB3436363126F08309BBB70860C6A50F1581E607
4c8ed3f11561a13d7a9b3516ee8c59d6
Malicious
Meeting Arrangement.pdf.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[Base64-Block]
LNK CommandLine
Malicious
.executed
Malicious
.subscript.vbs
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path arc:zip>lnk~T1027~T1059.001~T1059.005~T1204.002~T1218~T1218.005>lnk:cmd~T1027~T1059.005>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk~T1027~T1059.001~T1059.005~T1204.002~T1218~T1218.005>lnk:cmd~T1027~T1059.005>scr:vbs~T1027~T1059.005
Shape arc:zip>lnk>lnk:cmd>scr:vbs
malicious 4 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4c8ed3f11561a13d7a9b3516ee8c59d6
Malicious
Meeting Arrangement.pdf.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[Base64-Block]
LNK CommandLine
Malicious
.executed
Malicious
.subscript.vbs
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
4c8ed3f11561a13d7a9b3516ee8c59d6 › Meeting Arrangement.pdf.lnk › LNK CommandLine › [PowerShell Command]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
4c8ed3f11561a13d7a9b3516ee8c59d6 › Meeting Arrangement.pdf.lnk › LNK CommandLine
Deobfuscated PowerShell UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
4c8ed3f11561a13d7a9b3516ee8c59d6 › Meeting Arrangement.pdf.lnk › [Lnk Summary] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
@(0, [huhuhuhuhuhuhuhuhuhuhu
4c8ed3f11561a13d7a9b3516ee8c59d6 › Meeting Arrangement.pdf.lnk › [Lnk Summary] › [Lnk Summary].deobfuscated.vbs › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙