Deep Malware Analysis of 5ab9b307e592a64992bccdfdea8cdd46 | md5: 5ab9b307e592a64992bccdfdea8cdd46 | Zip Archive | LNK | Malicious | LOLBin | T1218: System Binary Proxy Execution | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated | T1105

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	5ab9b307e592a64992bccdfdea8cdd46
Sha1	211095582086f5e8fcd89b524b5b8a98fbe03cf2
Sha256	c7c19812efc4ea911da10fb8603a338bb8d8ca15e6eb1a58913cf5a509d5fe50
Sha384	c3beba44f921f176ae6464d6cf4c1487ea8c66cf5e3638ebb181a3229cd8fab91309045f7fe0d26974c24eb6bc16bbe1
Sha512	c287007264fefabb0615706f605dc7370502fd001babecdb343cf6396973bf6b3f2bb39373b4068b144b6f5833f151dc39704bf89c718763082b1035f0ea8bf4
SSDeep	3072:YZBNr1w6gZdcmhEBt9zSiLxqTuYa8Cx9ntUBP0vvmV0bJJ9:U1OZthEBt9ShTpXk/UB8vv3
TLSH	0DF312448F5650E5C90CF98DB86012A09D9271CD9D1FCED96B590E7C3CDAF2B622CBE2

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 1secondary ignored: 5

bin 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1027~T1059.001~T1105

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	https:huhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.4
CreationDate	D:20260622144153+03'00'
ModifiedDate	D:20260622144153+03'00'
Producer	iText 2.1.7 by 1T3XT
/ModDate	D:20260622144153+03'00'
/Expires	0
/CreationDate	D:20260622144153+03'00'
/Producer	iText 2.1.7 by 1T3XT

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

[Servihuhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential