Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a1dcc40ddf65d338fd250de1b280db1a
Sha1 0d53708e600f4aa8f7e5b6daedd34126f764e21a
Sha256 4adb8b4f38f0199a238831a9c8892bae329b8737e5c00d26eaf072b8b4e43106
Sha384 8f9a8e3c04ab92f520a5492435a5a29af7e23151717bc271f8643369393b0a1dbd9d152befc2ab902c546ab28e26edd8
Sha512 e2ffceb6754ddf3a36a89cd27766763385ceeeb76fc6971b85004d0cfd6615369c50ec1ff8684f47da65fbc531bdbf9a29328b0a969e6e57080e4ea95eb185ce
SSDeep 12288:D2nmjG3l6ggy/rUqhRIQefCaCP/KgeMW883mEIi7nX8Wx6FG:Dp63l6jqhRIUyMWcEN7nNxkG
TLSH 0AC42365CC17229B4B22607F1C44D37AAEB16233B010F84B96693DB21EAD9E56EF171C
a1dcc40ddf65d338fd250de1b280db1a
Malicious
DAS_London_2026_Programme.pdf.lnk
Malicious
PDF @0x0000017F
Malicious
[PowerShell Command]
Malicious
PDF @0x00004A24
Text (Preview)
Page #1
#Stream obj 7 0
#Stream obj 9 0
#Stream obj 5 0
#Stream obj 16 0
#Stream obj 23 0
#Stream obj 30 0
#Stream obj 42 0
#Stream obj 46 0
#Stream obj 47 0
Structure
DAS_London_2026_Programme.pdf.lnk
0x0009C909.svg
0x0009C909.svg-preview.jpg
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1059.001~T1105>pdf>pdf:stream>bin
Shape arc:zip>lnk>scr:ps1>pdf>pdf:stream>bin
malicious 6 nodes
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1059.001~T1105>pdf>pdf:stream>img
Shape arc:zip>lnk>scr:ps1>pdf>pdf:stream>img
malicious 6 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhu
URL in PowerShell #4 https:huhuhuhuhuhuhu
URL in PowerShell #5 https:huhuhuhuhuhuhu
URL in PowerShell #6 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16 http:/huhuhuhuhuhuhu
URL in PowerShell #17 http:/huhuhuhuhuhuhu
URL in PowerShell #18 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.4
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #4 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #5 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #6 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16 URImalicious
http:/huhuhuhuhuhuhu
URL in PowerShell #17 URImalicious
http:/huhuhuhuhuhuhu
URL in PowerShell #18 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
updatehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$rukp huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
a1dcc40ddf65d338fd250de1b280db1a
Malicious
DAS_London_2026_Programme.pdf.lnk
Malicious
PDF @0x0000017F
Malicious
[PowerShell Command]
Malicious
PDF @0x00004A24
Text (Preview)
Page #1
#Stream obj 7 0
#Stream obj 9 0
#Stream obj 5 0
#Stream obj 16 0
#Stream obj 23 0
#Stream obj 30 0
#Stream obj 42 0
#Stream obj 46 0
#Stream obj 47 0
Structure
DAS_London_2026_Programme.pdf.lnk
0x0009C909.svg
0x0009C909.svg-preview.jpg
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhu
URL in PowerShell #4 https:huhuhuhuhuhuhu
URL in PowerShell #5 https:huhuhuhuhuhuhu
URL in PowerShell #6 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16 http:/huhuhuhuhuhuhu
URL in PowerShell #17 http:/huhuhuhuhuhuhu
URL in PowerShell #18 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #2 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #3 URImalicious
https:huhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #4 URImalicious
https:huhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #5 URImalicious
https:huhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #6 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #14 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #15 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #16 URImalicious
http:/huhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #17 URImalicious
http:/huhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
URL in PowerShell #18 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › PDF @0x0000017F
Deobfuscated PowerShell UNKNWOWNmalicious
updatehuhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › LNK CommandLine › [Base64-Block] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$rukp huhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › LNK CommandLine › [Base64-Block] › [Base64-Block]
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › LNK CommandLine › [Base64-Block] › [Base64-Block] › [Base64-Block]
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › LNK CommandLine › [Base64-Block] › [Base64-Block] › [Base64-Block] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
a1dcc40ddf65d338fd250de1b280db1a › DAS_London_2026_Programme.pdf.lnk › LNK CommandLine › [Base64-Block] › [Base64-Block] › [Base64-Block] › [Deobfuscated PS] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙