Malicious
LNK File
MD5: 64bc29705fa0b0c0f2e6cb9295c6f623
Size: 16.57 KB
application/x-ms-shortcut
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Shortcut Link File
Size
16.57 KB · 16,568 B
Hashes
MD5
64bc29705fa0b0c0f2e6cb9295c6f623
Sha1
e7db2117f21116fb3c7526739e5bfd26623c6542
Sha256
250d41a4f0654fb73935b6aff3ea975ec8cbdeb9c1bc127858ec3ec5f6390290
Sha384
559337bf282708d3a72aa5882f8c3befcd54d50f72d706e2f366555f0d29df85286834ce8596da3610ac6d72dc98a00b
Sha512
eb988b28007fabcac03b6533dc035c6d1381f79ae1d9b1cadfa6712310a1d714dfb445a3251b2eda8b3211ca18051560af27ab360a0c14260c61699f049b2cc6
SSDeep
24:8d/Cf3DwdfCXGiXnSpVT6XtBxb1En96pMERrBCU:8lCPkdfYXnSpEtb1U6p9r
TLSH
D1726A8121E80308F2B6FF399A7BAB41093BF990ED71CB6C8E508C5D2954942ED75F66
8 malicious · 8 files
LNKScan_003.pdf.lnkT1059.001 · T1059.003 · T1059.005LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]T1059.005
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary].deobfuscated.vbsT1059.005
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential8 malicious · 8 files
LNKScan_003.pdf.lnkT1059.001 · T1059.003 · T1059.005LOLBin
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary]T1059.005
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Lnk Summary].deobfuscated.vbsT1059.005
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Scan_003.pdf.lnk
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Scan_003.pdf.lnk › [Lnk Summary]
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Scan_003.pdf.lnk › LNK CommandLine › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Scan_003.pdf.lnk › [Lnk Summary] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account