Malicious
Malicious

a1dcc40ddf65d338fd250de1b280db1a

Share on LinkedIn
Print
ZIP Archive
MD5: a1dcc40ddf65d338fd250de1b280db1a
Size: 553.66 KB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a1dcc40ddf65d338fd250de1b280db1a
Sha1 0d53708e600f4aa8f7e5b6daedd34126f764e21a
Sha256 4adb8b4f38f0199a238831a9c8892bae329b8737e5c00d26eaf072b8b4e43106
Sha384 8f9a8e3c04ab92f520a5492435a5a29af7e23151717bc271f8643369393b0a1dbd9d152befc2ab902c546ab28e26edd8
Sha512 e2ffceb6754ddf3a36a89cd27766763385ceeeb76fc6971b85004d0cfd6615369c50ec1ff8684f47da65fbc531bdbf9a29328b0a969e6e57080e4ea95eb185ce
SSDeep 12288:D2nmjG3l6ggy/rUqhRIQefCaCP/KgeMW883mEIi7nX8Wx6FG:Dp63l6jqhRIUyMWcEN7nNxkG
TLSH 0AC42365CC17229B4B22607F1C44D37AAEB16233B010F84B96693DB21EAD9E56EF171C
a1dcc40ddf65d338fd250de1b280db1a
Malicious
DAS_London_2026_Programme.pdf.lnk
Malicious
PDF @0x0000017F
Malicious
[PowerShell Command]
Malicious
PDF @0x00004A24
Text (Preview)
Page #1
#Stream obj 7 0
#Stream obj 9 0
#Stream obj 5 0
#Stream obj 16 0
#Stream obj 23 0
#Stream obj 30 0
#Stream obj 42 0
#Stream obj 46 0
#Stream obj 47 0
Structure
DAS_London_2026_Programme.pdf.lnk
0x0009C909.svg
0x0009C909.svg-preview.jpg
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1059.001~T1105>pdf>pdf:stream>bin
Shape arc:zip>lnk>scr:ps1>pdf>pdf:stream>bin
malicious 6 nodes
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1059.001~T1105>pdf>pdf:stream>img
Shape arc:zip>lnk>scr:ps1>pdf>pdf:stream>img
malicious 6 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhu
URL in PowerShell #4 https:huhuhuhuhuhuhu
URL in PowerShell #5 https:huhuhuhuhuhuhu
URL in PowerShell #6 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16 http:/huhuhuhuhuhuhu
URL in PowerShell #17 http:/huhuhuhuhuhuhu
URL in PowerShell #18 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.4
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #4 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #5 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #6 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16 URImalicious
http:/huhuhuhuhuhuhu
URL in PowerShell #17 URImalicious
http:/huhuhuhuhuhuhu
URL in PowerShell #18 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
updatehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$rukp huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙