Deep Malware Analysis of abffa50bd9ebee64d32bb904bd828e63 | md5: abffa50bd9ebee64d32bb904bd828e63 | Zip Archive | LNK | Malicious | LOLBin | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	abffa50bd9ebee64d32bb904bd828e63
Sha1	ab9085cc167db05182656f99da16e1b5b4f2fa4b
Sha256	cb7a2ab4fba4e27419af796df33bbbb293926bcb7316a420b6ebc9f7e4c6994c
Sha384	b0386dcedd1b0168fd202cfc7888ab7bfa2f20207f2a7b863dfcadfcd161fe6c53dd850354fde776dd42f2e433b9c9a6
Sha512	88963aa4e242c11462d68559041c703faede584cdd048dff939a3c3433a8c64fe8b0283ae360bfcd7e8b413f416eafd3b11574b7fc8fce15904aff14f683cc17
SSDeep	96:XphsrZNYCddTAIp0PtomSs3LJwGN4GZr/U:uLTh0PtoU7JwlGZg
TLSH	B4717E1452FA342DD8F648B81CB6F61922CC546269AC4458F095676CF738FC72D0210E

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd

Shape arc:zip>lnk>lnk:cmd

malicious 3 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential