Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d7f27f225967140a8d89886ab7346618
Sha1 465cc40fdcb4f343d11b70e70f05697ae28be57e
Sha256 d782bdd883c0a1f8c484e50765a1481116f9e700fea7dc9e39df2ab4cb9dd8a2
Sha384 651d8ed7aee4a2aa178830982dc19654678278e7f1e2f5eee1e1c36acf1dc5e6519a08f485ab8c7c6467b605dfe7c70a
Sha512 31a9503a653b2839ec18a4f914ebaae4fabf92e5fde4d8244c3244266c8bb1b8a201cb52827641d08f8ce55b15535e8a75443607d044e664932e2118248c0cfb
SSDeep 3072:sYPdx+eEvrLgAXxx6aDEbbCDx/TzFpICMyb3:sYP3UbFDAbkx/fFS7u3
TLSH 9CB312D5BC2F8560D07975BE2C9AE334621217A47B4901F52D78E3F312EBB478B62263
d7f27f225967140a8d89886ab7346618
Malicious
SANC_Nine_KBW_Seoul_Invitation.pdf.lnk
Malicious
PDF @0x00000189
Malicious
[PowerShell Command]
Malicious
PDF @0x00004A3A
Text (Preview)
Page #1
Page #2
#Stream obj 23 0
#Stream obj 9 0
#Stream obj 8 0
#Stream obj 13 0
#Stream obj 12 0
#Stream obj 17 0
#Stream obj 16 0
#Stream obj 24 0
Structure
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[Base64-Block]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1059.001~T1105>pdf>pdf:stream>bin
Shape arc:zip>lnk>scr:ps1>pdf>pdf:stream>bin
malicious 6 nodes
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.4
Author
(anonymous)
CreationDate
D:20260928022456+00'00'
Creator
(unspecified)
ModifiedDate
D:20260928022456+00'00'
Subject
(unspecified)
Title
(anonymous)
Producer
ReportLab PDF Library - (opensource)
/Author
(anonymous)
/CreationDate
D:20260928022456+00'00'
/Creator
(unspecified)
/ModDate
D:20260928022456+00'00'
/Producer
ReportLab PDF Library - (opensource)
/Subject
(unspecified)
/Title
(anonymous)
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
updatehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$rukp huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d7f27f225967140a8d89886ab7346618
Malicious
SANC_Nine_KBW_Seoul_Invitation.pdf.lnk
Malicious
PDF @0x00000189
Malicious
[PowerShell Command]
Malicious
PDF @0x00004A3A
Text (Preview)
Page #1
Page #2
#Stream obj 23 0
#Stream obj 9 0
#Stream obj 8 0
#Stream obj 13 0
#Stream obj 12 0
#Stream obj 17 0
#Stream obj 16 0
#Stream obj 24 0
Structure
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[Base64-Block]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL #1 https:huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhu
d7f27f225967140a8d89886ab7346618 › SANC_Nine_KBW_Seoul_Invitation.pdf.lnk › PDF @0x00000189
Deobfuscated PowerShell UNKNWOWNmalicious
updatehuhuhuhuhuhuhuhuhuhuhu
d7f27f225967140a8d89886ab7346618 › SANC_Nine_KBW_Seoul_Invitation.pdf.lnk › [Lnk Summary] › [Base64-Block] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$rukp huhuhuhuhuhuhuhuhuhuhu
d7f27f225967140a8d89886ab7346618 › SANC_Nine_KBW_Seoul_Invitation.pdf.lnk › [Lnk Summary] › [Base64-Block] › [Base64-Block]
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
d7f27f225967140a8d89886ab7346618 › SANC_Nine_KBW_Seoul_Invitation.pdf.lnk › [Lnk Summary] › [Base64-Block] › [Base64-Block] › [Base64-Block]
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
d7f27f225967140a8d89886ab7346618 › SANC_Nine_KBW_Seoul_Invitation.pdf.lnk › [Lnk Summary] › [Base64-Block] › [Base64-Block] › [Base64-Block] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
$encryhuhuhuhuhuhuhuhuhuhuhu
d7f27f225967140a8d89886ab7346618 › SANC_Nine_KBW_Seoul_Invitation.pdf.lnk › [Lnk Summary] › [Base64-Block] › [Base64-Block] › [Base64-Block] › [Deobfuscated PS] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙