Deep Malware Analysis of 7aa5f78836c596192702e164fbf304fd | md5: 7aa5f78836c596192702e164fbf304fd | Zip Archive | LNK | Malicious | LOLBin | T1218: System Binary Proxy Execution | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated | T1105

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	7aa5f78836c596192702e164fbf304fd
Sha1	bddc74cc893a7ab646cb027af60493d34ab1b388
Sha256	1ec7d1c20c93f562405cb4833d12e06357b66865eb13eaf8e43aeb4e71ebe718
Sha384	df5db7a6176bcc82858288db6183c139463ee91e09c723d564adaffc784445e1d8628c8b552f7ca89323880ff645934a
Sha512	b885523ccebbd590711223c7bf8c38dfe47203fe870055da0adbf7b0e5b5413bb4857b9d9302a92a89a996ea1a10484a17b0e8009faf9d1ba15e513b276b8974
SSDeep	12288:IgOY4+YbZVOdiK9otbwj4XZ6dJObbtRzBPdDdYENULDVbZ:IgDwZo4K+tbwQ6m7t5dZULDT
TLSH	65B423EE884BE96EC1626075C3AA8EE558E65FF937E7E71B7C08742834144111FFA903

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3

bin 2img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1027~T1059.001~T1105

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.4
ModifiedDate	D:20240620070451Z
Producer	iLovePDF
Version	1.4
CreationDate	D:20240412090934+00'00'
Creator	Chromium
ModifiedDate	D:20240412090934+00'00'
Producer	Skia/PDF m76
/Producer	iLovePDF
/ModDate	D:20240620070451Z
/Creator	Chromium
/Producer	Skia/PDF m76
/CreationDate	D:20240412090934+00'00'
/ModDate	D:20240412090934+00'00'

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

[Servihuhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential