Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5ab9b307e592a64992bccdfdea8cdd46
Sha1 211095582086f5e8fcd89b524b5b8a98fbe03cf2
Sha256 c7c19812efc4ea911da10fb8603a338bb8d8ca15e6eb1a58913cf5a509d5fe50
Sha384 c3beba44f921f176ae6464d6cf4c1487ea8c66cf5e3638ebb181a3229cd8fab91309045f7fe0d26974c24eb6bc16bbe1
Sha512 c287007264fefabb0615706f605dc7370502fd001babecdb343cf6396973bf6b3f2bb39373b4068b144b6f5833f151dc39704bf89c718763082b1035f0ea8bf4
SSDeep 3072:YZBNr1w6gZdcmhEBt9zSiLxqTuYa8Cx9ntUBP0vvmV0bJJ9:U1OZthEBt9ShTpXk/UB8vv3
TLSH 0DF312448F5650E5C90CF98DB86012A09D9271CD9D1FCED96B590E7C3CDAF2B622CBE2
5ab9b307e592a64992bccdfdea8cdd46
Malicious
Запрос-спецификация от компании ООО ТРОЙ СТАНДАРТ НД на сентябрь 2026г.lnk
Malicious
LNK CommandLine
Malicious
[Base64-Block]
Malicious
[Lnk Summary]
Malicious
выписка егрюл 3257085795_22062026.pdf
Text (Preview)
Page #1
Page #2
Page #3
Page #4
Page #5
Page #6
Page #7
Page #8
Page #9
#Stream obj 18 0
#Stream obj 46 0
#Stream obj 47 0
#Stream obj 23 0
#Stream obj 49 0
#Stream obj 25 0
#Stream obj 19 0
#Stream obj 14 0
#Stream obj 17 0
#Stream obj 3 0
#Stream obj 4 0
#Stream obj 2 0
#Stream obj 26 0
#Stream obj 36 0
#Stream obj 37 0
#Stream obj 41 0
#Stream obj 51 0
#Stream obj 40 0
#Stream obj 42 0
#Stream obj 43 0
#Stream obj 44 0
#Stream obj 45 0
#Stream obj 1 0
#Stream obj 9 0
#Stream obj 7 0
Structure
Карточка организации.docx
[Content_Types].xml
_rels
.rels
word
document.xml
_rels
document.xml.rels
theme
theme1.xml
settings.xml
styles.xml
webSettings.xml
fontTable.xml
docProps
core.xml
app.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 1secondary ignored: 5
bin 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1027~T1059.001~T1105
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.4
CreationDate
D:20260622144153+03'00'
ModifiedDate
D:20260622144153+03'00'
Producer
iText 2.1.7 by 1T3XT
/ModDate
D:20260622144153+03'00'
/Expires
0
/CreationDate
D:20260622144153+03'00'
/Producer
iText 2.1.7 by 1T3XT
LNK: Command Execution UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
[Servihuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5ab9b307e592a64992bccdfdea8cdd46
Malicious
Запрос-спецификация от компании ООО ТРОЙ СТАНДАРТ НД на сентябрь 2026г.lnk
Malicious
LNK CommandLine
Malicious
[Base64-Block]
Malicious
[Lnk Summary]
Malicious
выписка егрюл 3257085795_22062026.pdf
Text (Preview)
Page #1
Page #2
Page #3
Page #4
Page #5
Page #6
Page #7
Page #8
Page #9
#Stream obj 18 0
#Stream obj 46 0
#Stream obj 47 0
#Stream obj 23 0
#Stream obj 49 0
#Stream obj 25 0
#Stream obj 19 0
#Stream obj 14 0
#Stream obj 17 0
#Stream obj 3 0
#Stream obj 4 0
#Stream obj 2 0
#Stream obj 26 0
#Stream obj 36 0
#Stream obj 37 0
#Stream obj 41 0
#Stream obj 51 0
#Stream obj 40 0
#Stream obj 42 0
#Stream obj 43 0
#Stream obj 44 0
#Stream obj 45 0
#Stream obj 1 0
#Stream obj 9 0
#Stream obj 7 0
Structure
Карточка организации.docx
[Content_Types].xml
_rels
.rels
word
document.xml
_rels
document.xml.rels
theme
theme1.xml
settings.xml
styles.xml
webSettings.xml
fontTable.xml
docProps
core.xml
app.xml
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
LNK: Command Execution UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
5ab9b307e592a64992bccdfdea8cdd46 › Запрос-спецификация от компании ООО ТРОЙ СТАНДАРТ НД на сентябрь 2026г.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
[Servihuhuhuhuhuhuhuhuhuhuhu
5ab9b307e592a64992bccdfdea8cdd46 › Запрос-спецификация от компании ООО ТРОЙ СТАНДАРТ НД на сентябрь 2026г.lnk › LNK CommandLine › [Base64-Block]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhu
5ab9b307e592a64992bccdfdea8cdd46 › Запрос-спецификация от компании ООО ТРОЙ СТАНДАРТ НД на сентябрь 2026г.lnk › LNK CommandLine › [Base64-Block]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙