Deep Malware Analysis of d15e4117a4ab43f96f2802b9308f3055 | md5: d15e4117a4ab43f96f2802b9308f3055 | Zip Archive | LNK | Malicious | LOLBin | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	d15e4117a4ab43f96f2802b9308f3055
Sha1	9a46419e7a12e90274ccd122bb220af71e5d8de1
Sha256	4ef64c8e0fa5b37000a02372f90989af60132829a5a4ec3bdfd45d48d5fcc379
Sha384	23a6fe7feec79693aed697fe70174978e383dd5f4e1d0cc0fefe22b9ea5bba190b38fb4721cbe70b549629979e352a50
Sha512	f34dede05f5c93b4b1db536d05aa2420109f20978fee1d287e490dfebb2cfe8f12eaf0213ea2c196f9179bbe1c4f90bf188c8733702885c8d5640997135536b1
SSDeep	96:nPw0RkWBjMY7PqIeG1uQbPfw7ZwPWyUjoM:nJXBj7TqIB3bPmwPkjoM
TLSH	B8615C4E94140029EB4F66B1EA5C3CA486C28FE905E7EC46ABD0F22839D2B83275F156

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd

Shape arc:zip>lnk>lnk:cmd

malicious 3 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential