Malicious
53bb942bbde6c5d74939f78ea637694d
LNK File
MD5: 53bb942bbde6c5d74939f78ea637694d
Size: 929.5 KB
application/x-ms-shortcut
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Shortcut Link File
Size
929.5 KB · 929,504 B
First seen
2026-08-07 10:15 · 2 months ago
Last seen
2026-08-07 10:15 · 2 months ago
Last analysis
2026-08-07 10:15 · 2 months ago
Hashes
MD5
53bb942bbde6c5d74939f78ea637694d
Sha1
05ce4513a051743130acc54a4264c0bb091ddfaa
Sha256
79e3f0d3f1527538660528242a3349e5f638ad0952ad2ecac2c43754f31d7bf1
Sha384
dc1e94e0e056057d6b648a4e4edb6cba5c35e8b3983eb35c61e2d3a279a944e4e40d221821a033f705d2aebc0ac08c36
Sha512
60aece6a36f7d1db19820e0baae604cd9254a746a6ada00454f2a6a32eb28aeb3f10a56612769c00beb8f28a6576de2a850cdce9e6db1453939f38c687df9ce6
SSDeep
24:8d/aqWHIxRiqX+yDW9KT62TS6BxU/n9qcMQoRrGUuu:8laaQqXFDW9l5SUF3K9
TLSH
EF15DF8226E80300F1B6FE39CE7A9B85083BBA80ED75D7AC8A50CC1C5554615FA75F36
8 malicious · 8 files
LNK53bb942bbde6c5d74939f78ea637694dT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
VBS[Lnk Summary]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
VBS[Lnk Summary].deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
lnk~T1027~T1059.001~T1059.003~T1059.005~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape
lnk>lnk:cmd>scr:ps1
malicious
3 nodes
Path
lnk~T1027~T1059.001~T1059.003~T1059.005~T1202~T1204.002>scr:ps1~T1027~T1059.001
Shape
lnk>scr:ps1
malicious
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential8 malicious · 8 files
LNK53bb942bbde6c5d74939f78ea637694dT1027 · T1059.001 · T1059.003LOLBin
SHLNK CommandLineT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
VBS[Lnk Summary]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
VBS[Lnk Summary].deobfuscated.vbsT1059.005
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
53bb942bbde6c5d74939f78ea637694d
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
53bb942bbde6c5d74939f78ea637694d › [Lnk Summary]
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
53bb942bbde6c5d74939f78ea637694d › [Lnk Summary] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
53bb942bbde6c5d74939f78ea637694d › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account