Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 592b04c38ff195bae20623ccada92224
Sha1 bc278d4f960053847d201f60592051565142a863
Sha256 7b1c1b85784b92f8d4e7a7f3e6edd8a3b90cd708c75c09f17e62241433c2f3f9
Sha384 1aa8ef4be6a39eb88c87ea9616ad17ea5c6284b917cfa16ee0df87e15865582106ec3244cd1e8c7457b300294595dabb
Sha512 29f6728400b15749da8402923e9c3d6c89e1279428dedf79e98ce6868121a2d37ec6c3e7d1534dea2efa1c1072d680f8891cbb17b35c6b55427b218c63cc0805
SSDeep 24576:Fvtj3jH7Ifkg/2IEqejW7bwO2Geng+rc97ZCTdkAeQvFKrueC51Rug:Fvtj7eH2hy7bvStm0T2pCbMg
TLSH 30452314C728906EC0B61AB2A0F1193DE4715EF9590FEB4DEFE7294A909B244377533A
592b04c38ff195bae20623ccada92224
Malicious
Documents
Malicious
1.Operations Overview and Dashboard.pdf
Text (Preview)
Page #1
Page #2
Page #3
#Stream obj 5 0
#Stream obj 10 0
#Stream obj 11 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
#Stream obj 33 0
Structure
2. Office Network and Local Statistics.pdf
Text (Preview)
Page #1
Page #2
#Stream obj 5 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
#Stream obj 33 0
#Stream obj 32 0
3. Office statistics.pdf
Text (Preview)
Page #1
Page #2
Page #3
Page #4
#Stream obj 5 0
#Stream obj 10 0
#Stream obj 11 0
#Stream obj 17 0
#Stream obj 33 0
#Stream obj 35 0
4. Analytics.pdf
Text (Preview)
Page #1
Page #2
Page #3
#Stream obj 5 0
#Stream obj 10 0
#Stream obj 11 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
#Stream obj 22 0
#Stream obj 23 0
#Stream obj 26 0
#Stream obj 27 0
#Stream obj 30 0
#Stream obj 31 0
#Stream obj 33 0
#Stream obj 32 0
#Stream obj 35 0
#Stream obj 34 0
5. Key findings.pdf
Text (Preview)
Page #1
#Stream obj 5 0
#Stream obj 10 0
#Stream obj 11 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
6. Supplement Panel Architecture and Operating Logic.pdf
Text (Preview)
Page #1
Page #2
Page #3
Page #4
Page #5
Page #6
#Stream obj 5 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
#Stream obj 33 0
#Stream obj 32 0
#Stream obj 35 0
#Stream obj 37 0
#Stream obj 36 0
#Stream obj 39 0
#Stream obj 38 0
#Stream obj 41 0
#Stream obj 40 0
#Stream obj 43 0
#Stream obj 45 0
#Stream obj 44 0
#Stream obj 47 0
#Stream obj 46 0
#Stream obj 49 0
#Stream obj 51 0
#Stream obj 50 0
#Stream obj 53 0
#Stream obj 52 0
#Stream obj 55 0
#Stream obj 54 0
#Stream obj 57 0
#Stream obj 56 0
#Stream obj 59 0
Terms of Partnership.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Lnk Summary]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Name Value
Version
1.4
Producer
pypdf
Version
1.4
Producer
pypdf
/Producer
pypdf
/Producer
pypdf
Version
1.4
Producer
pypdf
/Producer
pypdf
Version
1.4
Producer
pypdf
/Producer
pypdf
Version
1.4
Producer
pypdf
/Producer
pypdf
Version
1.4
Producer
pypdf
/Producer
pypdf
LNK: Command Execution UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
& ((Gehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
592b04c38ff195bae20623ccada92224
Malicious
Documents
Malicious
1.Operations Overview and Dashboard.pdf
Text (Preview)
Page #1
Page #2
Page #3
#Stream obj 5 0
#Stream obj 10 0
#Stream obj 11 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
#Stream obj 33 0
Structure
2. Office Network and Local Statistics.pdf
Text (Preview)
Page #1
Page #2
#Stream obj 5 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
#Stream obj 33 0
#Stream obj 32 0
3. Office statistics.pdf
Text (Preview)
Page #1
Page #2
Page #3
Page #4
#Stream obj 5 0
#Stream obj 10 0
#Stream obj 11 0
#Stream obj 17 0
#Stream obj 33 0
#Stream obj 35 0
4. Analytics.pdf
Text (Preview)
Page #1
Page #2
Page #3
#Stream obj 5 0
#Stream obj 10 0
#Stream obj 11 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
#Stream obj 22 0
#Stream obj 23 0
#Stream obj 26 0
#Stream obj 27 0
#Stream obj 30 0
#Stream obj 31 0
#Stream obj 33 0
#Stream obj 32 0
#Stream obj 35 0
#Stream obj 34 0
5. Key findings.pdf
Text (Preview)
Page #1
#Stream obj 5 0
#Stream obj 10 0
#Stream obj 11 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
6. Supplement Panel Architecture and Operating Logic.pdf
Text (Preview)
Page #1
Page #2
Page #3
Page #4
Page #5
Page #6
#Stream obj 5 0
#Stream obj 14 0
#Stream obj 15 0
#Stream obj 17 0
#Stream obj 33 0
#Stream obj 32 0
#Stream obj 35 0
#Stream obj 37 0
#Stream obj 36 0
#Stream obj 39 0
#Stream obj 38 0
#Stream obj 41 0
#Stream obj 40 0
#Stream obj 43 0
#Stream obj 45 0
#Stream obj 44 0
#Stream obj 47 0
#Stream obj 46 0
#Stream obj 49 0
#Stream obj 51 0
#Stream obj 50 0
#Stream obj 53 0
#Stream obj 52 0
#Stream obj 55 0
#Stream obj 54 0
#Stream obj 57 0
#Stream obj 56 0
#Stream obj 59 0
Terms of Partnership.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Lnk Summary]
Malicious
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
592b04c38ff195bae20623ccada92224 › Documents › Terms of Partnership.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
& ((Gehuhuhuhuhuhuhuhuhuhuhu
592b04c38ff195bae20623ccada92224 › Documents › Terms of Partnership.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙