Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 2.4 KB LNK File classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 5 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.003, T1202: INDIRECT COMMAND EXECUTION, T1204.002 and T1218: SYSTEM BINARY PROXY EXECUTION. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d511b6fe91ef43489335dd7608784648506a2cfff5fb60558e378ada1888f3ef
MD5
a92a7b0a8659c94870684d402a18e0eb
Verdict
Malicious
File type
LNK File · 2.4 KB
MITRE ATT&CK
T1027T1059.001T1059.003T1202: INDIRECT COMMAND EXECUTIONT1204.002T1218: SYSTEM BINARY PROXY EXECUTION

Cite this report: https://app.malva.re/sha256/d511b6fe91ef43489335dd7608784648506a2cfff5fb60558e378ada1888f3ef

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Shortcut Link File
Size
2.48 KB · 2,476 B
First seen
2026-10-28 15:00 · 6 hours ago
Last seen
2026-10-28 15:00 · 6 hours ago
Last analysis
2026-10-28 15:00 · 6 hours ago
Hashes
MD5 a92a7b0a8659c94870684d402a18e0eb Sha1 3a06abc31c585401f3a2b8237f1f70ba469fb24c Sha256 d511b6fe91ef43489335dd7608784648506a2cfff5fb60558e378ada1888f3ef Sha384 ef6b07b69a1cbb598009f2f1593ead48baad1e4344a5094128b2c491db659f084c5be41057bf79945d23b812e012f79d Sha512 38e7089f020f6a605dcf64aa2f5b9306cb5987825bbeaa70abd61039991f5b73750d95b4e3feea568505b7fbc93367a026c1567a6bcdba604d594b31bd5545d2 SSDeep 24:8k/BHYVKVWb2++/CWRkiyo6vv/E2oESCZQsLc3l1PdUPRHeQJ9t8rcNCi9+Lw5D6:8g5aQOo6ns2xPZqV3+n8rECi9+74ald TLSH DC512A243DEA021CF6A3EE757CA476458D77FEA5DA225D8D0080834A6852A00EDE1F3B

7 malicious · 8 files
LNKa92a7b0a8659c94870684d402a18e0eb
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1027~T1059.001
Shape lnk>lnk:cmd>scr:ps1
malicious 3 nodes
Path lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001
Shape lnk>scr:ps1
malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
(New-Ohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

7 malicious · 8 files
LNKa92a7b0a8659c94870684d402a18e0eb
SHLNK CommandLine
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[Lnk Summary]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
No malware configuration was found at this point.

LNK: Command Execution UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
a92a7b0a8659c94870684d402a18e0eb
Deobfuscated PowerShell UNKNWOWNmalicious
(New-Ohuhuhuhuhuhuhuhuhuhuhu
a92a7b0a8659c94870684d402a18e0eb › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙