Deep Malware Analysis of b7cf12dfc06b0f255d296282cf07d343 | md5: b7cf12dfc06b0f255d296282cf07d343 | LNK | Malicious | LOLBin | T1218: System Binary Proxy Execution | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	b7cf12dfc06b0f255d296282cf07d343
Sha1	79915e23e7f01505077c9af343226cffc2b7742d
Sha256	30abf0f74236118cc418abd68181fb525cc21cf5f9d6274764f8d4990a79bd4c
Sha384	03ba808105a0ac4a4b13c82ef7e7109e3cb9ca66330d810998324722912bdbc12acac8f7e513ade8b37b5a2ee6db7216
Sha512	3f110e6f4aa9e8c04a986534123cee2c8ae68dabb2cf345c89818b85be9a17d0352f3835a544936416a9ffcd152ddc6250ba84f624f438b7b1a5b8b7966eae5f
SSDeep	24:8VWduI1JV1rvYjK5hWxxMAKWkp+/CWP2+/CtKrGse4I0WyISpK6+/CUMlIFTxSqq:8S1Jni/ymBBIGBU3Sq4Z
TLSH	5641AD111BF51718D2B78B3AACB6F2128732BD65ED124FDE428092895C64229E875F2F

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001

Shape lnk>lnk:cmd

malicious 2 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Invokhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential