Malicious
56fd579bd9e1879a103110453292bdcb
LNK File
MD5: 56fd579bd9e1879a103110453292bdcb
Size: 3.46 KB
application/x-ms-shortcut
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 56fd579bd9e1879a103110453292bdcb |
| Sha1 | e1d88df042694313d14f15aed26cca956d8e5738 |
| Sha256 | 4f954c7c6228ca4eb0e6b7c3d5f2d025467996866c2d9ae4dd1f005cb6cb1f19 |
| Sha384 | cc3c213d9aa41c8ebb1197706cc9d2dba51a85006a387ebd743597d36fa4e85686d58313ed069a7484d4c5d9ffed8edc |
| Sha512 | 166826df993d70fc04c76f6f71d32228870725f8018827aaf3bf0fec689ae931421a4305566823137a0d732d41ef5cb818a8cec8e22001022469c63bc5419853 |
| SSDeep | 48:8wgVkRGix5VTDR7BT68c3rA0Dedy9XuH+:8fVkRGqlRUF1u |
| TLSH | AF617B112BFA0318F3B78F79A8BEA616493BBD56EE228B8D4040554818F1714D8B6F77 |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
lnk>lnk:cmd>scr:ps1
malicious
3 nodes
Path
lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001~T1105
Shape
lnk>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-c $shuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$sh = huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
56fd579bd9e1879a103110453292bdcb
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
56fd579bd9e1879a103110453292bdcb › [Lnk Summary]
Deobfuscated PowerShell
UNKNWOWNmalicious
-c $shuhuhuhuhuhuhuhuhuhuhu
56fd579bd9e1879a103110453292bdcb › LNK CommandLine
Deobfuscated PowerShell
UNKNWOWNmalicious
$sh = huhuhuhuhuhuhuhuhuhuhu
56fd579bd9e1879a103110453292bdcb › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.